Webhooks

Send data to your external systems when events happen in your workspace.

Setting Up Webhooks

Webhooks are configured as Actions:

1. Go to Actions
2. Create a new action with trigger (e.g., "Data Record Created")
3. Select Send Webhook as the action type
4. Enter your HTTPS endpoint URL — Gravity Rail rejects http:// URLs in production because webhook payloads can include PHI (member name, email, phone, DataRecord field values), and HIPAA 45 CFR 164.312(e)(2)(ii) requires that PHI be encrypted in transit. http:// URLs are still permitted in development environments for local testing against localhost / webhook.site / host.docker.internal.

Security

Request signing

When an event rule's webhook action has a signing secret configured, Gravity Rail sends an HMAC-SHA256 signature on every delivery:

• Header: X-Webhook-Signature
• Format: t={unix_timestamp},v1={hex_digest}
• Signed message: the ASCII string {timestamp}. concatenated with the raw JSON body bytes (exactly as sent on the wire)
• Secret: auto-generated per event rule on creation; view or rotate it in the rule's webhook action settings (not under API Keys)

Reject requests when the timestamp is more than five minutes old (replay protection). Compare signatures with a constant-time function.

Python:

python

Node.js:

javascript

Payloads are JSON in the request body. Signing is optional per rule; rules without a secret still deliver over HTTPS in production.

Payload Examples

Data Record Created

json

Member Updated

json

Testing

1. Use webhook.site for development
2. Create a test action pointing to your test URL
3. Trigger the event
4. Verify the payload arrives and the X-Webhook-Signature header validates (if signing is enabled)

Tips

• HTTPS is enforced in production - The API rejects http:// URLs at create/update time with a 400 error so PHI in webhook payloads is never transmitted unencrypted (HIPAA 45 CFR 164.312(e)(2)(ii)). Existing rules with http:// URLs are also blocked at delivery time and surfaced as webhook_url_blocked in the rule UI — update the URL to https:// to resume delivery.
• Handle retries - Implement idempotent handlers
• Check logs - Failed webhooks appear in action logs

Related

• Actions — Configure webhook triggers and conditions
• CEL Expressions — Write conditions to control when webhooks fire
• Template Variables — Dynamic variables available in webhook payloads