Webhooks
Setting up real-time, event-driven notifications from ConcordLink to external systems.
What are webhooks?
Webhooks are automated HTTP callbacks that send real-time data from ConcordLink to your external systems when specific events occur. Instead of polling ConcordLink for updates, webhooks push notifications to your application automatically.
When an event happens in ConcordLink, it sends an HTTP POST to your configured webhook URL, and your system receives and processes the data immediately, with no polling delays.
Adding a new webhook
- Navigate to Concord > Products > Base Product Template > Scripts > Webhooks.
- Select + Webhook in the upper-right corner, or select Add Webhook in the center of the page.
Webhook components
| Component | Description |
|---|---|
| URL | The HTTPS endpoint where ConcordLink sends webhook notifications. Must be publicly accessible, accept POST requests, and respond with HTTP 200-299 within 30 seconds. |
| Secret | A security token that proves the webhook came from ConcordLink. ConcordLink includes an HMAC-SHA256 signature in each webhook header (X-Link-Signature). |
| Events | The specific triggers that cause ConcordLink to send webhooks (e.g., record.created, payment.received, task.completed). |
Configuring a webhook
Enter the webhook URL
- Provide your endpoint URL. It must be HTTPS and publicly accessible.
- ConcordLink will send a test request. Confirm it responds with HTTP 200.
Configure security
- Select Generate Secret. ConcordLink creates a secure token automatically. Copy and store it securely.
- Enter your own secret token (minimum 32 characters, cryptographically secure).
Select events
Check only the events you need. Fewer events means less network traffic and simpler processing.
Save and test
- Select Create or Save.
- Verify your system received and processed the test webhook.
- Confirm the webhook shows Active status in the list.
Security best practices
| Practice | Details |
|---|---|
| Always use HTTPS | ConcordLink will reject non-HTTPS URLs. |
| Verify the signature | Calculate HMAC-SHA256 of the payload plus your secret and compare with the X-Link-Signature header. |
| Rotate secrets regularly | Change webhook secrets every 90 days; regenerate immediately if compromised. |
| Log all webhooks | Record receipt timestamp, payload data, processing status, and errors. |
| Handle retries | ConcordLink retries failed webhooks up to 5 times (at 1 min, 5 min, 30 min, 2 hr, and 24 hr). Ensure your endpoint is idempotent. |
Back to: Administrator Tasks and Actions