Webhooks

Webhooks allow you to receive real-time HTTP POST notifications when events occur in ReportFlow. Use them to trigger external workflows, sync data with other systems, or build custom integrations.

Real-Time

Events fire within seconds of the action.

Signed Payloads

Verify authenticity with HMAC signatures.

Retry Logic

Failed deliveries are retried with exponential backoff.

Creating a webhook

Navigate to Settings → Webhooks → Add Webhook. Enter a destination URL (must be HTTPS), select the events you want to subscribe to, and save. ReportFlow will immediately start sending events to that URL.

Available events

  • clockout.created — A new clockout was processed.
  • clockout.updated — A clockout status changed (approved, rejected).
  • commission.calculated — A commission payout was calculated.
  • rule.created — A new commission rule was created.
  • rule.updated — An existing rule was modified.
  • fraud.flagged — A clockout was flagged for potential fraud.

Payload structure

{ "event": "clockout.created", "timestamp": "2026-01-02T14:30:00Z", "data": { "id": "cko_abc123", "chatter": "jane", "total": 1500.00, ... } }

Verifying signatures

Each webhook request includes an X-ReportFlow-Signature header. Compute an HMAC-SHA256 hash of the raw request body using your webhook secret and compare it to the header value. If they match, the request is authentic.

Retry policy

If your endpoint returns a non-2xx status or times out, ReportFlow retries up to 5 times with exponential backoff (1 min, 5 min, 30 min, 2 hr, 12 hr). After all retries fail, the event is marked as failed and logged for manual review.

Next steps