Webhooks

A developer, admin, or owner can add an endpoint for the active environment. Notifiable calls that URL when a notification is delivered, fails, is opened, or is clicked, and when an event with a chosen name is recorded. A viewer can read the list, the signing secret, and the latest results.

How it works

An endpoint belongs to one app and one environment. Development and production do not share endpoints. An environment can have five endpoints. Production requires https. Development may also use http://localhost or http://127.0.0.1. A host that resolves to a private, loopback, or link-local address is refused. A disabled endpoint receives nothing.

The endpoint chooses any of notification.delivered, notification.failed, notification.opened, and notification.clicked, and any event name, including one that has not been recorded yet. A name is at most 80 characters. An endpoint can listen for 20 names. Delivered and failed are posted when that outcome is first stored. A later Expo receipt that turns a delivered notification into a failure is posted as notification.failed. An open or a click is posted only the first time. The push token is not included. Recording an event posts once to each enabled endpoint in that environment that lists the event name. The body uses that name as type, and data is the app, the environment, the event id, the name, the subscriber, and the properties. The four notification names are not posted again from the event.

Notifiable signs the raw body. The receiver can ignore a duplicate with Notifiable-Webhook-Id, which stays the same on every retry, including a replay. A 2xx response is success. Anything else is tried again immediately, after 1 minute, after 15 minutes, and after 1 hour. The fourth failure is the last. The response is stored up to 8,000 characters.

The page lists each endpoint for the active environment. A developer, admin, or owner adds one from a dialog: the URL, the delivery outcomes, the event names already recorded in this environment, and a field for another event name. Each row shows an Active or Inactive badge. Hovering an inactive row shows a red Delete. Hovering an active row shows Disable, which turns that endpoint off. A viewer can open the list and cannot add, disable, or delete an endpoint.

Opening an endpoint shows the events it listens for, a switch that turns it on or off, when it was created, and the signing secret. The secret starts with whsec_ and is stored encrypted. The first characters stay visible, and the rest can be revealed or copied. The latest deliveries are listed with a succeeded or failed badge. The selected delivery shows its id, time, HTTP status, attempt count, response, and the JSON that was posted. The response is kept up to 8,000 characters. Replay sends that same message again. The message id does not change.