> ## Documentation Index
> Fetch the complete documentation index at: https://docs.exoid.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuration

> Enable a campaign's webhook, set the URL and secret, and review the log of requests sent.

Every campaign has its own webhook. From here you turn delivery on, point to the endpoint that will receive the real-time HTTP notifications, and check what has been delivered.

<Info>
  The panel lives in **Settings (side toolbar) → Webhook**.
</Info>

<Frame caption="Webhook configuration screen">
  ![Webhook configuration screen in Exoid](https://69247ac52a74519d4fe5e2eb.featurebase-attachments.com/c/article/6925ab07b65089fc8e52b6f7/019adfdc-37e5-77dc-9f98-59d7aa900b08/b64u-d2ViaG9vay5wbmc.png)
</Frame>

## Panel fields

<ParamField path="Enable Webhook" type="toggle">
  Turns automatic delivery of HTTP requests on or off for this campaign.
</ParamField>

<ParamField path="Webhook URL" type="url" required>
  Full address of the endpoint that will receive the requests, for example `https://yourdomain.com/webhook`.
</ParamField>

<ParamField path="Webhook Secret Key" type="string">
  The secret used to digitally sign every payload with HMAC-SHA256. See [Signature and security](/en/webhooks/security) to implement verification.
</ParamField>

## Webhook Requests

Below the fields you'll find the chronological list of every call made. For each row you see:

| Column          | Content                                          |
| --------------- | ------------------------------------------------ |
| Timestamp       | When the request was sent                        |
| Destination URL | Endpoint contacted                               |
| Status code     | HTTP result returned, for example `200` or `405` |
| Detail          | Full content of the request that was made        |

Failed requests are logged too, with the status code that made them fail.

### Quick actions

| Action       | Effect                                        |
| ------------ | --------------------------------------------- |
| Refresh      | Updates the list of requests                  |
| Test Webhook | Sends a test request to your endpoint         |
| Save         | Applies the configuration changes             |
| Cancel       | Closes the panel without applying the changes |

<Tip>
  Use **Test Webhook** before publishing your study: it confirms that your endpoint answers `200` and that signature verification works, without putting real responses at risk.
</Tip>

## Technical details of the request

| Property     | Value                         |
| ------------ | ----------------------------- |
| Method       | `POST`                        |
| Content-Type | `application/json`            |
| X-Signature  | `sha256=...` (HMAC signature) |
| User-Agent   | `Exoid-Webhook/1.0`           |
| Timeout      | 30 seconds                    |

<Note>
  If your endpoint doesn't respond within 30 seconds, the request is considered failed and falls into the retry logic. Answer `200` immediately and process the payload asynchronously.
</Note>

## Next steps

<CardGroup cols={2}>
  <Card title="Signature and security" icon="shield" href="/en/webhooks/security">
    Recompute the HMAC-SHA256 signature and reject requests that aren't authentic.
  </Card>

  <Card title="Payload reference" icon="file-json" href="/en/webhooks/payload">
    What the JSON you receive contains, field by field.
  </Card>
</CardGroup>


## Related topics

- [July 1, 2026](/en/whats-new/2026-07-01.md)
- [Question types](/en/builder/question-types.md)
- [February 18, 2026](/en/whats-new/2026-02-18.md)