Webhook Payload Reference: Events, Fields, and Signature Verification

1. 1

   Know the three event types

   form.response fires on a completed submission. form.partial fires on each autosave while someone is still filling the form, if you've enabled syncing in-progress submissions. form.dropoff fires when a session is considered abandoned.

2. 2

   Read the shared fields

   Every payload includes event, formId, and formName. form.response adds submittedAt and a response array of { label, value } pairs, one per question. form.partial and form.dropoff add sessionToken, lastStep, and a partialAnswers array of { label, value } for whatever was filled in so far; form.dropoff also includes abandonedAt.

3. 3

   Route by header, not just body

   Each request carries an X-SiliForm-Event header with the event name, so you can route it before parsing JSON.

4. 4

   Verify the signature

   Recompute the HMAC-SHA256 of the raw request body using your form's webhook secret, then compare it (constant-time) against the value after sha256= in the X-SiliForm-Signature header.

5. 5

   Handle delivery limits

   Delivery has a 5-second timeout, and a failed delivery is not automatically retried. Have your endpoint respond quickly and do heavier processing asynchronously after acknowledging the request.

Frequently asked questions

Where do I get the webhook secret used to verify signatures?

It's shown when you set up the webhook — see Connect HubSpot or Zapier for the setup flow.

What happens if my endpoint times out?

The request fails and isn't retried automatically, since delivery has a 5-second timeout. Treat any gap as a possible missed delivery rather than something SiliForm will resend.