Webhook settings
Add webhook endpoints, choose the signals they receive, send a test, and read every delivery with its payload and your endpoint's response.
What it is
The Webhooks tab is where admins tell Noru to call their own systems when something changes: a risk is created, a policy is approved, evidence expires, a supplier reports a breach. Each endpoint is an https address with its own signing secret and its own list of signals. Below the endpoints, the Deliveries log shows every call Noru made, what it sent and what your endpoint answered.
This page covers the screens. How to build the receiver (the request format, verifying the signature, retries) is in Webhooks for developers.
Where to find it
SettingsWebhooksIt sits under Automation, next to Workflows.
Key actions
Add an endpoint
hooks.example.com/noru. Noru adds https:// for you.An organization can have up to 10 endpoints. Supplier risk signals appear only in organizations with supplier risk management.
Send a test delivery
Open the endpoint's … menu and choose Send test delivery. Noru sends a
signed webhook.test delivery right away, whatever signals the endpoint is
subscribed to, and opens it in the delivery log so you can see what your
endpoint answered. Use it while you build the receiver, and after you rotate a
secret. The endpoint must be on.
Read a delivery
The Deliveries section lists the last 100 deliveries, newest first. Use the menu at the top right to show one endpoint, or Show deliveries in an endpoint's menu. Click a row, or its Details button, to open it:
| Part | What it shows |
|---|---|
| Summary | The status, the signal, the endpoint, the delivery id and, for a delivery sent by a workflow, a link to the run |
| Request | The headers sent with each attempt, including webhook-id |
| Body | The exact JSON body that was signed and sent. Copy body copies it. |
| Attempts | Every attempt, newest first: when, what your endpoint answered (or why nothing answered), how long it took, and the first 4 KB of its response body |
If your receiver returns an error message in its response body, you see it under the attempt. See Debug a failing endpoint for what each outcome usually means.
Redeliver
Fix the problem, then click Redeliver on a delivery that is Delivered,
Failed or Not sent. It is sent again now with the same webhook-id, so
a receiver that drops duplicates processes it only once. A delivery still being
retried cannot be redelivered until it finishes.
Edit, turn off and delete
From the endpoint's … menu:
- Edit changes the address, description or signals. Signals you add apply to what happens from then on.
- Turn off stops deliveries; Turn on starts them again and clears the count of failures in a row.
- Delete removes the endpoint and its delivery log. It cannot be undone.
Rotate the secret
Rotate secret in the endpoint's menu creates a new secret and shows it once. The old one stops working at once, so update your receiver straight away. Do this if the secret may have leaked, or as routine.
Statuses and fields
Endpoint status
| Status | Meaning | Set by |
|---|---|---|
| On | Deliveries are sent. | You |
| On, last delivery failed | Still sending, but the most recent attempts failed; the label counts the failures in a row. | Noru |
| Off | You turned it off. Nothing is sent. | You |
| Off after repeated failed deliveries | Ten attempts in a row failed, so Noru turned it off. Fix the receiver, then Turn on. | Noru |
| Off until you rotate its secret | The endpoint predates the current signing format. Rotate secret turns it back on. | Noru |
Delivery status
The API returns the value in code; the app shows the label.
| Status | Meaning | Set by |
|---|---|---|
Sending or Retryingpending | Sending before the first attempt; Retrying after a failed attempt, with the next one due at the time shown. | Noru |
Deliveredsucceeded | Your endpoint answered 2xx. | Noru |
Failedfailed | Every attempt failed, after about a day and a half of retries. Redeliver once it is fixed. | Noru |
Not sentcancelled | The endpoint was turned off or deleted before the delivery went out. | Noru |
Tips and gotchas
The signing secret is shown once, when you add the endpoint or rotate it. If you lose it, rotate it; there is no way to show it again.
Have your receiver return a short reason in its error responses, for
example {"error": "signature mismatch"}. The delivery log keeps the start
of every response, so you can tell a wrong secret from a bug without
opening your own logs.
A workflow's Send a webhook step uses these endpoints too. Its messages appear in the same delivery log, with a link to the run that sent them.
What Noru does not do
- It does not send to
httpaddresses or private networks, and it does not follow redirects. - It does not send signals that happened while an endpoint was off once you turn it back on.
- It does not keep the full response from your endpoint, only its status and first 4 KB.
Related
- Webhooks for developers: request format, signature verification, retries
- Workflows
- Inbound hooks
Last updated on