Skip to main content
The Webhooks integration sends a completed (or, if configured, partial) submission to any HTTPS endpoint you control — method, body format, headers, and field mapping are all configurable per form, with SSRF protection built in.

​
Configure a feed

1

Add the Webhooks integration

On a form, add a Webhooks feed from the integrations panel.
2

Set the request URL

HTTPS only. Supports {{field_name}} merge tags for dynamic paths (e.g. https://example.com/hooks/{{plan}}).
3

Choose method and format

POST (default), GET, PUT, PATCH, or DELETE. POST/PUT/PATCH send json or form (application/x-www-form-urlencoded) bodies; GET/DELETE always send data as query params.
4

Add custom headers (optional)

One HEADER=value per line. Values support the same {{field_name}} merge tags. Host, Content-Length, and Transfer-Encoding are always stripped for transport safety.
5

Pick the body

All fields sends every answer keyed by field name, optionally with submission meta (form_id, form_title, submission_id, submitted_at). Select fields sends only the KEY=field_name (or literal) pairs you list.

​
Payload shape

​
SSRF protection

Every resolved URL — after merge-tag interpolation — is validated before a request is sent:
Only https:// is accepted, on port 443 or 8443. Any other scheme or port is rejected.
URLs containing a userinfo component (https://user:pass@host/...) are rejected outright.
localhost, *.local, *.localhost, cloud metadata hosts (metadata.google.internal, kubernetes.default, …), and any hostname or literal IP that resolves to a private/reserved range (RFC1918, loopback, link-local) are rejected.
A hostname’s resolved A/AAAA records are checked at sanitize time — a public-looking hostname that resolves to a private IP is still blocked. Immediately before the HTTPS request, Flex Forms re-resolves and, when curl is available, pins those public IPs via CURLOPT_RESOLVE so the connect prefers the audited addresses.
If the resolved URL fails validation, the webhook dispatch fails immediately with “Webhook URL rejected” — no request is ever sent to a disallowed host. This applies even when the base URL is set via a {{merge_tag}} that resolves to something unsafe at submit time.
Residual TOCTOU: Pinning reduces DNS-rebinding risk but cannot eliminate a theoretical race between the second resolve and the TCP handshake if an authoritative DNS answer changes in that window. Prefer allowlisted, stable HTTPS endpoints you control.
Need typed, versioned events instead of a raw generic payload? Most CRMs, spreadsheets, and Slack are available as first-class integrations — reach for a generic webhook when you’re posting to your own backend or an automation tool without a dedicated Flex Forms integration.
Last modified on September 7, 2026