Webhook Docs — Xasform

Overview

Setiap kali ada respons baru pada form yang memiliki automasi aktif, Xasform akan mengirimkan notifikasi ke integrasi yang Anda pilih.

Tersedia 6 tipe integrasi:

Webhook

Discord

Slack

Google Sheets

MS Teams

Payload Format

POST Body (JSON) application/json

{
  "event": "response.created",
  "form": {
    "id": 16,
    "title": "Feedback Form",
    "slug": "feedback-form"
  },
  "response": {
    "id": 52,
    "created_at": "2026-09-14 10:30:00",
    "data": {
      "f1": "Budi Santoso",
      "f2": "budi@example.com",
      "f3": "Layanan sangat memuaskan!"
    }
  },
  "fields": {
    "f1": "Nama Lengkap",
    "f2": "Email",
    "f3": "Pesan"
  },
  "labels": ["lolos seleksi", "prioritas"]
}

Field Reference

Field	Tipe	Deskripsi
event	string	Selalu `response.created`
form.id	integer	ID form
form.title	string	Judul form
form.slug	string	Slug URL form
response.id	integer	ID respons
response.created_at	string	Timestamp pembuatan (Y-m-d H:i:s)
response.data	object	Key-value data jawaban (field ID → value)
fields	object	Mapping field ID → label/ nama field
labels	array	Daftar label yang diterapkan pada respons

Request Headers

Content-Type: application/json
X-Xasform-Signature: sha256=a1b2c3d4e5f6...

Verifikasi Signature

Setiap request webhook disertai header X-Xasform-Signature yang berisi HMAC-SHA256 dari body JSON menggunakan secret Anda.

PHP

$secret = 'kunci-rahasia-anda';
$body   = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);
$given  = $_SERVER['HTTP_X_XASFORM_SIGNATURE'] ?? '';

if (!hash_equals($expected, $given)) {
    http_response_code(401);
    exit('Invalid signature');
}

$data = json_decode($body, true);
// Proses $data...

Node.js

const crypto = require('crypto');

const secret = 'kunci-rahasia-anda';
const expected = 'sha256=' + crypto
  .createHmac('sha256', secret)
  .update(rawBody)
  .digest('hex');

if (!crypto.timingSafeEqual(
  Buffer.from(expected),
  Buffer.from(req.headers['x-xasform-signature'] || '')
)) {
  return res.status(401).send('Invalid signature');
}

Python

import hmac, hashlib

secret = 'kunci-rahasia-anda'
body = request.get_data(as_text=True)
expected = 'sha256=' + hmac.new(
    secret.encode(), body.encode(), hashlib.sha256
).hexdigest()

given = request.headers.get('X-Xasform-Signature', '')
if not hmac.compare_digest(expected, given):
    abort(401)

data = json.loads(body)

Retry Policy

Jika webhook endpoint mengembalikan status code selain 2xx, Xasform akan melakukan retry dengan exponential backoff:

Retry 1: setelah 2 menit
Retry 2: setelah 4 menit
Retry 3: setelah 8 menit
Retry 4: setelah 16 menit
Retry 5: setelah 32 menit → status failed

Total maksimal 5 percobaan. Status job dapat dilihat di tabel automation_jobs.

Quick Test (cURL)

# Simulasi payload dari Xasform
curl -X POST https://your-endpoint.com/webhook \
  -H "Content-Type: application/json" \
  -H "X-Xasform-Signature: sha256=$(echo -n '{"event":"response.created",...}' | openssl dgst -sha256 -hmac "your-secret" | awk '{print $2}')" \
  -d '{"event":"response.created","form":{"id":16,"title":"Test"},"response":{"id":1,"data":{"f1":"value"}},"fields":{"f1":"Field 1"},"labels":[]}'