Skip to main content
RevoEngine Webhooks are durable outbound HTTP attempts. Use them when RevoEngine should notify an external system asynchronously without holding an Endpoint response open.
This workspace does not create inbound subscriptions. To receive a partner callback, publish an authenticated Endpoint, validate the request, and then create a Job or Event.

​
Create a webhook in the UI

Open Webhooks and select Trigger webhook. The form exposes: The Platform API also supports searchable metadata, static-egress proxy, maskDetails, and controlled creator/system attribution.
The webhook request field is maxRetries; maxAttempts is rejected. An instance retry policy can impose a lower cap. Job and Agent retry policies keep their separate maxAttempts contract.

​
Credentials and sensitive details

Static headers are persisted configuration. Do not place a long-lived API key in a screenshot, example, searchable metadata, or unmasked history. For stronger credential control, call the external API from a Component with api.httpCall() and resolve the credential from Secrets. This also lets you compute signatures, rotate versions, validate responses, and write a business transaction around the call. If a Webhook must contain a sensitive header, disable unnecessary detail retention and configure maskDetails for the persisted projection.

​
Attempt lifecycle

The Webhooks grid is operational history. A row records status, attempt count, scheduled time, elapsed time, payload size, creator, and metadata. Message, immediately after Size, previews the persisted request when it is at most 32 KiB; larger requests show a compact placeholder and remain available from Webhook details. You can still filter by fields in the complete stored request. The outbound request belongs to this one Webhook; delivery attempts are separate evidence, not copies of the request payload. Open Delivery attempts in the Webhook details to inspect each attempt’s scheduled, started, response, and retry timestamps, result, and duration. Entries are paginated. The API equivalent is GET /api/v1/automation/webhook/{webhookId}/attempts?offset=0&limit=20; it returns { data, total, offset, limit } and accepts a maximum limit of 200. A delayed Webhook starts SCHEDULED; an immediately eligible one starts PENDING. PROCESSING means delivery is in progress. FINISHED, ERROR, and CANCELLED describe its terminal outcome. scheduledFor retains the initial requested time, while nextEligibleAt can change for retry backoff. Attempt evidence can arrive out of order. A late response for attempt 2 does not replace a newer attempt 3 in the summary, and duplicate evidence does not increment the record version. A terminal outcome is not reopened by a late delivery notification. Check individual attempts when investigating timestamps rather than assuming their arrival order is execution order.
Cancellation stops eligible future processing; it cannot recall a request already accepted by the remote server. Delete and restore change platform visibility, not remote state.

​
Roles

​
Design for reliable delivery

The receiver should treat the custom ID or another stable business key as idempotent. A transport timeout is ambiguous: the receiver may have committed the request even though RevoEngine did not receive its response. Use metadata to correlate the webhook with the originating Job, Event history, or business object. Alert on terminal failure and exhausted attempts rather than every transient retry.
Verify that the same idempotency key was used on every attempt and that the receiver stores the first accepted result. Do not reduce retries as the primary duplicate-control mechanism.
Check scheduled time, current attempt, cancellation state, and platform delivery logs. Confirm the destination DNS, TLS, timeout, and static-egress allowlist.
Check saveDetails and masking policy. Absence from history can be intentional and does not mean an empty body was sent.

​
Production checklist

  • Require HTTPS.
  • Use an idempotency key understood by the receiver.
  • Set an explicit maximum attempt policy.
  • Mask or avoid credentials in retained request details.
  • Use static egress only when the receiver needs allowlisting.
  • Correlate the row with an operation or business ID.
  • Monitor terminal failure and cancellation.
See HTTP integrations when the integration needs an immediate response, multipart data, SSE, or streamed files.
Last modified on October 5, 2026