Webhook request

Makeform sends a request to your webhook when a respondent completes a submission. Webhooks are managed in the dashboard or through MCP; the REST API does not provide webhook endpoints.

Method

The default method is POST. A webhook can also use GET, PUT, PATCH, or DELETE. A GET request has no body or signature.

Headers

Header	Value
`Content-Type`	`application/json` on methods with a body
`User-Agent`	`Makeform/1.0`
`X-MakeForm-Event`	`form_submission`
`X-MakeForm-Form-ID`	The form ID
`X-MakeForm-Submission-ID`	The submission ID
`X-MakeForm-Delivery-ID`	The delivery ID
`X-MakeForm-Timestamp`	The submission’s `submittedAt` time, not the send time
`X-MakeForm-Signature`	Included when the webhook has a signing secret
Custom headers	Included as configured; they cannot override `X-MakeForm-*` headers

If the webhook has a signing secret, the signature format is sha256=<hex>. It is an HMAC-SHA256 of the exact raw request body, keyed with the signing secret. Verify it against the raw request bytes before parsing the JSON.

Body

A POST delivery has this JSON shape. formData contains the stored answers keyed by field name; values depend on the field type. emailVerification and emailRisk appear only when they apply.

{
  "deliveryId": "7d6d1c45-8d5c-4de8-9f25-81c41b7e813a",
  "submissionId": "SUBMISSION_ID",
  "formId": "FORM_ID",
  "formData": {
    "name": "Jordan Lee",
    "email": "[email protected]"
  },
  "submittedAt": "2026-11-10T18:42:00.000Z",
  "formName": "Product feedback"
}

Field	Type	Description
`deliveryId`	string	Delivery ID. It stays stable for the submission, so you can use it to ignore duplicates.
`submissionId`	string	ID of the completed submission.
`formId`	string	ID of the form.
`formData`	object	Stored answers keyed by field name. Answer values depend on their field types.
`submittedAt`	string	Submission time as an ISO timestamp.
`formName`	string	Name of the form.
`emailVerification`	object	Present only when email verification applies.
`emailRisk`	object	Present only when email risk information applies.

The body has no event field. The event is identified by the X-MakeForm-Event header.

Example

POST /your-webhook HTTP/1.1
Host: receiver.example.com
Content-Type: application/json
User-Agent: Makeform/1.0
X-MakeForm-Event: form_submission
X-MakeForm-Form-ID: FORM_ID
X-MakeForm-Submission-ID: SUBMISSION_ID
X-MakeForm-Delivery-ID: 7d6d1c45-8d5c-4de8-9f25-81c41b7e813a
X-MakeForm-Timestamp: 2026-11-10T18:42:00.000Z

{
  "deliveryId": "7d6d1c45-8d5c-4de8-9f25-81c41b7e813a",
  "submissionId": "SUBMISSION_ID",
  "formId": "FORM_ID",
  "formData": {
    "name": "Jordan Lee",
    "email": "[email protected]"
  },
  "submittedAt": "2026-11-10T18:42:00.000Z",
  "formName": "Product feedback"
}

The event fires when a submission is completed for the first time, including when a previously partial submission is completed. Partial saves do not trigger it. Makeform sends each submission once and does not retry deliveries, including after a receiver returns 5xx or 429. The delivery timeout is 30 seconds.