A webhook sends a message to a web address you own each time something happens in SplashSend, such as someone subscribing or an order arriving. Use it to keep a CRM or your own app up to date. Setting one up needs someone who can run code at that address.

Add an endpoint

  1. Go to Setup → Webhooks and click Add endpoint.
  2. Give it a Name, such as “Sync to our CRM”.
  3. Enter the Endpoint URL. It must start with https:// and be reachable on the public internet.
  4. Under Events to send, tick the events you want.
  5. Click Create endpoint.
  6. Under Save your signing secret, copy the secret and keep it safe, because it's only shown once. Then click I've saved it.
Give the endpoint a name and an address, then pick its events.
Give the endpoint a name and an address, then pick its events.

You can have up to 10 endpoints, each at its own address. The owner and admins can set them up and see their deliveries.

The events

  • People events are Person subscribed, Person unsubscribed and A person's details changed. Person subscribed is sent when someone joins now, through a form, the API, an AI assistant or your Shopify store, or when you add them by hand. It isn't sent for people brought in by an import or by your store's first sync, unless the import was set to start automations.
  • Nothing an app does while it's in test mode sends a webhook. See Making your own app with AI.
  • Email events are Campaign sent, Email delivered, Email opened, Link clicked, Email bounced and Marked as spam.
  • Commerce events are Order placed and Order shipped.
  • Collect events are Form answer / review received and Form submitted. A form's Send it to another tool action sends Form submitted, with the answers.
  • Drip events are Someone started a drip, sent when someone goes into a drip, and A drip reached a Notify your systems step.
  • Your own events are An event your systems sent, sent when one of your own events arrives through the API or from an app, such as a booking.

What a message looks like

Each message is a POST with a JSON body like this:

{"id": "evt_…", "event": "order.placed", "timestamp": "2026-10-02T09:15:00.000Z", "data": {…}}

The id stays the same when a message is tried again or sent again, so your code can skip one it has already handled. The timestamp is when that copy was sent.

The data holds ids and the person's email address, and never anything secret. Email events also carry the emailSendId and the campaignId, and for a Cruise or drip email the scheduledEmailId or dripStepId. The reference at splashsend.com/api/docs shows an example of every event.

Check a message came from SplashSend

Each message has two headers. X-SplashSend-Event names the event. X-SplashSend-Signature is a hex HMAC-SHA256 of the raw request body, made with your signing secret. Work it out yourself from the raw body and compare the two before you trust the message. In Node.js:

crypto.createHmac("sha256", secret).update(rawBody).digest("hex")

Compare them with a constant-time check such as crypto.timingSafeEqual.

Replies and failures

  • Reply with any 2xx status within 10 seconds to say you've received it.
  • If the reply is anything else, or no reply comes, SplashSend tries again after 5 seconds and again 15 seconds after that, so each message is tried three times in all.
  • A redirect counts as a failure, so give the address your server answers on.
  • If an endpoint's messages keep failing for a whole day, at least 20 in a row, the endpoint is paused and we email the account's owner and admins. Its card shows Paused and when.

To start a paused endpoint again, fix the problem and click Test to check that your server replies. Then switch the endpoint back on with its switch, which clears the run of failures, and click Send failed ones again under Deliveries to send the messages that didn't get through in the last 30 days.

Testing and the delivery log

  • Test sends a test message, with the event name webhook.test, and shows the status code your server replied with. A failed test never counts towards pausing.
  • Deliveries shows the latest 50 delivery attempts from the last 30 days, each with your server's reply, so a message that was tried more than once appears once for each try. The card also says when the endpoint last delivered, or when a delivery last failed. Redeliver sends one again, with the same id, a new timestamp and your current secret. Send failed ones again sends every message from the last 30 days that never got through, a few at a time.
  • The ⋯ menu has Edit, to change the name, address or events, Regenerate secret, which makes a new secret and stops the old one working straight away, and Delete, which removes the endpoint and its delivery history.
Test an endpoint and see every delivery in its log.
Test an endpoint and see every delivery in its log.

Endpoints added by apps

An app you've connected, such as Zapier, can add endpoints of its own, so it hears about events the moment they happen. They're marked Added by the app. You can switch one off or delete it, but only the app can change where it sends or which events it gets. Removing the app removes them.