Submissions into Make scenarios. HMAC optional.
Updated March 2026
Make lets you build workflows with branching and error handling. Point a Sutrena webhook at a Make Custom Webhook module, and submissions trigger your scenario in real-time. You can verify the HMAC signature if you want the extra security, but it's not required.
1. Create a Custom Webhook module in Make
New scenario in Make. Add a "Custom webhook" trigger. It gives you a URL. Copy it and leave the scenario listening.
2. Get a Sutrena API key
Grab a trial key or use yours.
curl -X POST https://sutrena.com/api/trial3. Create a Sutrena webhook
Point it at your Make URL and link it to your form. The response includes a secret -- save that if you want HMAC verification later.
curl -X POST https://sutrena.com/api/webhooks \
-H "Authorization: Bearer st_trial_xxx" \
-H "Content-Type: application/json" \
-d '{
"url": "https://hook.us1.make.com/abcdefghijk",
"description": "Submissions to Make scenario"
}'
# Response includes: "secret": "whsec_xxx"
# Save this secret for HMAC verification
# Link to your form
curl -X PATCH https://sutrena.com/api/forms/frm_xxx \
-H "Authorization: Bearer st_trial_xxx" \
-H "Content-Type: application/json" \
-d '{ "webhookIds": ["wh_xxx"] }'4. Send a test submission and verify in Make
Submit something to your form. Make detects it and parses the JSON. Now you can map fields like data.payload.name to whatever comes next in your scenario.
curl -X POST https://sutrena.com/api/forms/frm_xxx/submissions \
-H "Content-Type: application/json" \
-d '{ "name": "Test User", "email": "[email protected]" }'5. Verify HMAC signature (optional but recommended)
Add a Custom Function module after the trigger to check the X-Webhook-Signature header against an HMAC-SHA256 of the body. Worth doing for production. Not strictly necessary for testing.
# The signature header format:
# X-Webhook-Signature: sha256=<hex-encoded-hmac>
# In Make, use a Custom Function module:
# 1. Input: request body (as text) and your webhook secret
# 2. Compute: HMAC-SHA256(secret, body)
# 3. Compare: result === X-Webhook-Signature header value
# 4. If mismatch, use a Router to stop the scenarioEvery submission triggers a POST to your webhook URL with this payload:
{
"id": "del_xxx",
"event": "form.submission",
"timestamp": "2026-01-15T10:30:00Z",
"data": {
"formId": "frm_xxx",
"submissionId": "sub_xxx",
"payload": {
"name": "Jane",
"email": "[email protected]"
}
}
}Once Make parses the first request, it knows the structure. Use data.payload.name, data.payload.email, data.formId, etc. The data structure panel shows everything.
Yes. Add a Router after the trigger. One route for critical severity, another for everything else. Standard Make branching.
If Make returns a non-2xx status, Sutrena retries with exponential backoff. Check GET /api/webhooks/{id}/deliveries to see what failed and why.
No. But without it, anyone who guesses your Make webhook URL could send fake data. So for anything beyond testing, it's a good idea.
Sutrena is the web runtime for AI agents. Three primitives — pages, forms, and dashboards — accessible through one API. Your agent creates web artifacts, humans interact with them, and your agent gets the data back. Framework-agnostic. Works from any MCP client or HTTP client.
1. Get a trial key (no auth, no signup)
curl -X POST https://sutrena.com/api/trial2. Create a form + dashboard from a template
curl -X POST https://sutrena.com/api/forms \
-H "Authorization: Bearer st_trial_xxx" \
-H "Content-Type: application/json" \
-d '{"templateId": "waitlist", "createDashboard": true}'Get a trial API key instantly with no signup, or create an account for the full experience.