Event
The first outbound event isform.submission.created. Its body includes a stable event ID, creation time, public form identity, normalized fields, and an answer map.
Delivery headers
Every request usesContent-Type: application/json and includes:
Custom headers may be configured, but they cannot replace Contact Button’s reserved delivery headers.
Verify signatures
When request signing is enabled, calculate an HMAC-SHA256 over the exact raw request body using the webhook signing secret, Base64-encode the binary digest, and compare it withContactButton-Signature using a constant-time comparison.
Handle retries safely
Return a2xx response only after accepting the event. Failed deliveries use increasing retry delays. Your endpoint should:
- Store
ContactButton-Event-Idwith a unique constraint. - Return success for an event it has already processed.
- Queue slow CRM or agent work instead of holding the request open.
- Treat event data as untrusted input and validate it before use.