Skip to main content

Webhook Management

This guide walks you through setting up and managing webhook endpoints to receive event notifications from the Allfly Connect API.

Overview​

Webhooks allow your application to receive instant notifications when events occur in Allfly Quest. This guide covers:

  • Navigating to the Webhook Management interface
  • Creating a new webhook endpoint
  • Configuring event subscriptions
  • Securing your endpoint with signing secrets
  • Testing webhook delivery
  • Monitoring and managing endpoints
note

You can also configure webhooks programmatically using the Connect API. See Consuming Webhooks for API-based configuration.

Prerequisites​

  • Administrator or Owner role in Allfly Quest
  • Access to your organization's Allfly Quest account
  • A publicly accessible HTTPS endpoint to receive webhook events

Step-by-Step Guide​

1. Navigate to Webhook Management​

  1. Log into your Allfly Quest account
  2. Click on Settings in the navigation menu
  3. Select the Integrations tab
  4. Click on Webhook Management to access the webhook dashboard
Integration Settings

The webhook dashboard displays all your configured endpoints and their current status.

2. Add a New Endpoint​

  1. Click the + Add Endpoint button
  2. The endpoint configuration page will appear

3. Configure Endpoint URL and Description​

  1. Enter your webhook endpoint URL in the Endpoint URL field
    • Must be a valid HTTPS URL (e.g., https://api.yourapp.com/webhooks/allfly)
    • The endpoint must be publicly accessible and ready to receive POST requests
  2. Add a Description to help identify this endpoint's purpose (e.g., "Production CRM Integration", "Slack Notifications")
Configure Endpoint
warning

Your endpoint must use HTTPS. HTTP endpoints are not supported for security reasons.

4. Subscribe to Event Types​

  1. Select which event types this endpoint should receive
tip

Start with a subset of event types during development and expand as needed. You can modify subscriptions at any time.

5. Create the Endpoint​

  1. Review your endpoint configuration
  2. Click Create to save the endpoint
  3. Your new endpoint will appear in the endpoints list with an "Enabled" status
Endpoint Created

6. Access Your Signing Secret​

After creating the endpoint, you'll need the signing secret to verify webhook signatures:

  1. Click on your newly created endpoint in the list
  2. Navigate to the Settings tab
  3. Locate the Signing Secret section
  4. Click Reveal (eye) to display the secret
  5. Copy it to your clipboard
  6. Store this secret securely in your application's environment variables or secrets manager
danger

Keep your signing secret secure. Anyone with access to this secret can forge webhook requests to your endpoint. Never commit it to version control.

7. Test Your Endpoint​

Before going live, test that your endpoint can receive and process webhooks:

  1. In the endpoint details view, click the Testing tab
  2. Select an event type from the dropdown
  3. Click Send Example to send a test webhook
  4. Verify that your endpoint receives the test event and returns a 2xx status code

If the test succeeds, you'll see a success message. If it fails, check:

  • Your endpoint URL is correct and publicly accessible
  • Your endpoint returns a 2xx status code within 15 seconds
  • Your firewall/security groups allow incoming requests from Svix
  • Your endpoint is not rejecting the request due to signature verification (disable temporarily for testing)

8. Monitor Webhook Deliveries​

  1. Click on your endpoint to view its details
  2. Navigate to the Logs tab
  3. View recent webhook deliveries, including:
    • Delivery timestamp
    • Event type
    • HTTP status code

Click on any message to view detailed information including the request payload, response, and headers.

Advanced Configuration​

Custom Headers​

You can add custom HTTP headers to all webhook requests sent to your endpoint:

  1. Click on your endpoint
  2. Navigate to the Advanced tab
  3. Add a new Key and Value
  4. Cliek the Plus button to save it

Common use cases include:

  • Authentication tokens
  • API versioning headers
  • Custom routing identifiers

Managing Endpoints​

Disabling an Endpoint​

To temporarily stop receiving webhooks without deleting the endpoint:

  1. Click on the endpoint
  2. Navigate to the 3 dots button on the top right
  3. Toggle the Disable Endpoint item
Disable Endpoint

The endpoint will stop receiving events but all configuration remains saved.

Rotating Signing Secrets​

To rotate your signing secret for security purposes:

  1. Click on your endpoint
  2. In the Signing Secret click on the down arrow
  3. Click on "Rotate Secret"
  4. Confirm the rotation
  5. Reveal the Signing Secret to copy it

Deleting an Endpoint​

To permanently remove a webhook endpoint:

  1. Click on the 3 dots menu on the top right
  2. Click on Delete
  3. Confirm the deletion
Delete Endpoint
warning

Deleting an endpoint is permanent and cannot be undone. The endpoint will immediately stop receiving events.