Guides/How to send form submissions to a webhook

How to send form submissions to a webhook

Every submission goes to Slack, Discord, Telegram, Teams, Google Chat, or your server. HMAC-signed.

Updated March 2026

Someone submits a form. You want to know about it. Webhooks send the data to a URL you pick -- Slack, Discord, Telegram, Microsoft Teams, Google Chat, your own server, wherever. Sutrena signs every webhook payload with HMAC-SHA256 so you can verify it is real. There are built-in templates for Slack, Discord, Telegram, Teams, and Google Chat, or you can receive raw JSON for custom wiring.

1. Create a form

You need a form before you can attach a webhook. Use a preset or create one with custom fields.

curl -X POST https://sutrena.com/api/forms \
  -H "Authorization: Bearer st_trial_abc123" \
  -H "Content-Type: application/json" \
  -d '{"workflowId": "contact"}'

2. Create a webhook

Attach a webhook to the form. Pick the target URL, the events to listen for, and an optional formatting template. The response includes a signing secret for verifying payloads.

curl -X POST https://sutrena.com/api/webhooks \
  -H "Authorization: Bearer st_trial_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "formId": "frm_xyz789",
    "url": "https://your-server.com/webhooks/sutrena",
    "events": ["form.submission"],
    "template": null
  }'

# Response:
# {
#   "id": "wh_abc123",
#   "signingSecret": "whsec_...",
#   "url": "https://your-server.com/webhooks/sutrena"
# }

3. Verify the HMAC signature

Every request has an X-Sutrena-Signature header. Compute HMAC-SHA256 of the raw body with your signing secret. If it does not match, reject it.

import crypto from "node:crypto";

function verifyWebhook(body: string, signature: string, secret: string) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(body)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your Express/Hono/Next.js handler:
app.post("/webhooks/sutrena", (req, res) => {
  const rawBody = req.body; // must be raw string, not parsed JSON
  const sig = req.headers["x-sutrena-signature"];

  if (!verifyWebhook(rawBody, sig, "whsec_your_secret")) {
    return res.status(401).send("Invalid signature");
  }

  const payload = JSON.parse(rawBody);
  console.log("New submission:", payload.data);
  res.status(200).send("OK");
});

4. Use platform templates (Slack, Discord, Telegram, Teams, Google Chat)

Set template when creating the webhook. Sutrena auto-formats the payload for the target platform. Telegram requires a telegramChatId parameter.

# Slack:
curl -X POST https://sutrena.com/api/webhooks \
  -H "Authorization: Bearer st_trial_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "formId": "frm_xyz789",
    "url": "https://hooks.slack.com/services/T00/B00/xxx",
    "template": "slack"
  }'

# Discord:
curl -X POST https://sutrena.com/api/webhooks \
  -H "Authorization: Bearer st_trial_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "formId": "frm_xyz789",
    "url": "https://discord.com/api/webhooks/123/token",
    "template": "discord"
  }'

# Telegram (requires telegramChatId):
curl -X POST https://sutrena.com/api/webhooks \
  -H "Authorization: Bearer st_trial_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "formId": "frm_xyz789",
    "url": "https://api.telegram.org/bot123:ABC.../sendMessage",
    "template": "telegram",
    "telegramChatId": "-100123456789"
  }'

# Microsoft Teams:
curl -X POST https://sutrena.com/api/webhooks \
  -H "Authorization: Bearer st_trial_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "formId": "frm_xyz789",
    "url": "https://xxx.webhook.office.com/webhookb2/...",
    "template": "teams"
  }'

# Google Chat:
curl -X POST https://sutrena.com/api/webhooks \
  -H "Authorization: Bearer st_trial_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "formId": "frm_xyz789",
    "url": "https://chat.googleapis.com/v1/spaces/.../messages?key=...",
    "template": "google-chat"
  }'

FAQ

How many webhooks can I create?

Free: 1. Pro: 10. Scale: unlimited.

What happens if my endpoint is down?

Sutrena retries with exponential backoff. After enough failures, the webhook gets marked as failing. You can check the status via the API with GET /api/webhooks/:id.

Can I send webhooks to Zapier?

Yes. Use a Zapier catch webhook URL with no template. Zapier gets the raw JSON, you map fields to whatever downstream action you want.

Is the signing secret rotatable?

Delete the webhook and create a new one with the same URL. Fresh secret. There is no in-place rotation -- avoids race conditions during verification.

What does the webhook payload look like?

Raw webhooks (no template): event type, form ID, submission ID, submitted data as key-value pairs, and a timestamp. Platform templates (Slack, Discord, Telegram, Teams, Google Chat) format it according to each platform's message specs.

Related

Build a waitlist with Slack alerts →Collect form data via API →Slack integration →Discord integration →Telegram integration →Telegram webhook guide →Teams integration →Google Chat integration →Upsert submission data →

What is Sutrena?

Sutrena is the web runtime for AI agents. Forms, Pages, Analytics, Webhooks, Automations — all through 67 MCP tools and one REST API. Your agent creates web artifacts, humans interact with them, and your agent gets the data back. Use any one feature or all of them together.

Pages

Deploy HTML instantly

Forms

Collect structured data

Automations

DSL-based pipelines with 14 step types

Analytics

Privacy-first, no cookies

Webhooks

Slack, Discord, Telegram

Get started in two API calls

1. Get a trial key (no auth, no signup)

curl -X POST https://sutrena.com/api/trial

2. Create anything — a page, form, automation, or analytics site

# Create a form
curl -X POST https://sutrena.com/api/forms \
  -H "Authorization: Bearer st_trial_xxx" \
  -H "Content-Type: application/json" \
  -d '{"name": "waitlist", "fields": [{"name": "email", "label": "Email", "type": "email", "required": true}]}'

# Or deploy a page
curl -X POST https://sutrena.com/api/pages \
  -H "Authorization: Bearer st_trial_xxx" \
  -H "Content-Type: application/json" \
  -d '{"slug": "index", "title": "My Site", "html": "<h1>Live</h1>"}'
/llms.txt/api/schema/llms-full.txt/.well-known/mcp.json

Ready to build?

Get a trial API key instantly with no signup, or create an account for the full experience.

Start buildingAgent docs
How to send form submissions to a webhook — Sutrena | Sutrena