Send form data to a webhook

The Webhook tab sends an accepted AJAX submission as an HTTPS JSON POST. Use it when another service needs structured values after POM Forms validation.

Prepare the receiver

The endpoint must:

• Use HTTPS.
• Accept JSON.
• Return a 2xx response for success.
• Handle duplicate delivery safely.
• Verify the signature when a secret is configured.
• Ignore fields it does not need.

Do not use a temporary request-inspection URL on a published form.

Configure delivery

1. Open the form.
2. Choose Webhook → Webhook Configuration.
3. Enable Enable Webhook.
4. Enter Webhook URL.
5. Optionally enter Secret Key.
6. Save the form.
7. Use the available webhook test with non-sensitive sample data.
8. Submit the active form and verify the production receiver.

The secret creates an X-POM-Forms-Signature header in this format:

sha256=HMAC_OF_RAW_JSON_BODY

The receiver must calculate the SHA-256 HMAC over the exact raw request body with the shared secret and compare it safely.

Understand the JSON shape

The payload groups:

• form: form ID and name
• submission: stored ID when available, processing time, and status
• fields: visible sanitized field values
• files: local or Drive file information
• meta: site URL, referring URL, and browser user agent when available

Fields hidden by conditional logic are omitted. The submission ID is null when storage is disabled or no record was stored.

Know the delivery boundary

Webhook processing happens after storage and notifications and before optional post creation. A webhook error is recorded in the submission event history when a stored entry exists, but the visitor can still receive the form success response. Monitor the receiving service when webhook delivery is business-critical.

Form Action URL (GET) and Form Action URL (POST) are separate submission modes. They bypass the Webhook tab and the rest of the internal action pipeline.

If delivery fails, confirm the URL is public HTTPS, the receiver accepts JSON within the request timeout, and it returns 2xx. Rotate the shared secret on both sides if it is exposed.