Custom webhook

The custom webhook integration sends your Gridwork account data as a JSON payload to an HTTPS endpoint you control. Use it to feed your own systems — a data warehouse, a CRM, an automation tool — without building against the database directly.

Setup

1. Open Settings → Integrations and click the Webhook card.
2. Enter your Endpoint URL. It must be a public https:// address. Internal or private addresses are rejected for security.
3. Under Data to include, choose which sections go into the payload (locations, employees, services, posts, gallery, references, custom fields). Only objects that are enabled for your account (Settings → Objects) appear here — a disabled object is never sent, and its toggle is hidden. Everything available is included by default.
4. Click Save. Gridwork generates a signing secret the first time you save.
5. Toggle Enable webhook on.

What gets sent

One payload bundles all companies in your account. Each delivery is a JSON object:

{
  "event": "account.sync",
  "occurredAt": "2026-07-13T10:00:00.000Z",
  "accountId": "…",
  "companies": [ { "id": "…", "company": { … }, "locations": [ … ] } ]
}

event is manual for a Send now and account.sync for an automatic delivery. Sections you switched off are omitted.

The structure differs from the website integration payload: the webhook wraps all companies in one account-level envelope and omits website-only fields. To see the exact payload — built from your real account data and your current toggles — click Download payload in the webhook modal to save it as a JSON file. (If your account has no companies yet, a representative sample is downloaded instead so you can still see the shape.)

When it fires

• Automatically — whenever your account data changes (a company, location, employee, service, post, reference, gallery item or custom field is added, edited or removed), Gridwork queues a delivery. Changes are coalesced, so a burst of edits results in a single send rather than one per edit.
• Manually — click Send now in the webhook modal to deliver the current data immediately.

Failed deliveries are retried automatically with an increasing delay. The Recent deliveries list in the modal shows the status, HTTP code and time of the last attempts.

Verifying the signature

Every request carries an X-Gridwork-Signature header of the form sha256=<hex>. Compute an HMAC-SHA256 of the raw request body using your signing secret and compare — reject the request if it does not match. This proves the request came from Gridwork and was not tampered with.

You can reveal, copy or rotate the signing secret in the webhook modal. Rotating invalidates the old value immediately, so update your receiver at the same time.

Turning it off

Toggle Enable webhook off. Your URL, toggles and signing secret are kept so you can re-enable later.

Privacy note

The payload can include personal data (for example employee names). You are responsible for the endpoint that receives it and for having a lawful basis and, where required, a data processing agreement with whoever operates that endpoint.