Webhooks — build your own automations

Updated October 8, 2026

Short answer

VideoTestimonials webhooks send an HTTP POST with a JSON body (event, timestamp, data) to a URL you choose when a testimonial is created, approved, rejected or deleted. Add them per space in Dashboard → Integrations → Automations with Add Webhook, then pause, re-enable or delete them from the same list. Every request carries an X-Webhook-Signature header, an HMAC-SHA256 of the body.

Webhooks let you react to testimonial events in any external system. We POST a JSON payload to a URL you choose whenever something happens — a new testimonial arrives, one gets approved, one gets deleted. Wire it up to Zapier, Make, n8n, or your own backend.

Add a webhook

Go to Dashboard → Integrations → Automations.
Find the space you want to add a webhook to and click + Add Webhook.
Fill in:
- URL — the endpoint that will receive the POST. Any URL that accepts POST requests works.
- Events — tick the events you want to subscribe to (see below).
Click Add Webhook. VideoTestimonials generates a signing secret for the webhook; the dashboard does not display it yet, so contact support if you need it to verify signatures.

Supported events

testimonial.created (New Testimonial) — a customer submitted a testimonial through a collection form, or one was created through the API
testimonial.approved (Approved) — a testimonial moved to approved status
testimonial.rejected (Rejected) — a testimonial was rejected
testimonial.deleted (Deleted) — a testimonial was removed

Verifying the signature

Every request includes an X-Webhook-Signature header — a SHA-256 HMAC of the request body, hex-encoded, signed with the webhook's secret. Requests also carry X-Webhook-ID and the user agent VideoTestimonials-Webhook/1.0. Verify the signature server-side to ensure the request actually came from us:

const expected = crypto
  .createHmac('sha256', WEBHOOK_SECRET)
  .update(rawBody)
  .digest('hex')
if (signature !== expected) return res.status(401).end()

Retries

Each delivery gets up to three attempts with a 10-second timeout, with a short wait (2 seconds, then 4) between attempts. A 4xx response is not retried. To inspect payloads while you build, point a webhook at a request inspector such as webhook.site first, as the Add Webhook dialog suggests.

Pause or delete

Click Pause on a webhook to stop deliveries without losing the config (its status changes from Active to Paused), and Enable to resume. Click the trash icon to delete it permanently, together with its delivery logs.

Frequently asked questions

What does a webhook payload look like?

A JSON object with event, for example testimonial.approved, an ISO timestamp, and data, which holds the testimonial record with HTML removed from its text. For a deleted testimonial, data contains only id, space_id and _deleted set to true. URLs on hooks.zapier.com receive a flat object of testimonial fields instead.

What happens if my endpoint is down or returns an error?

Each delivery gets up to three attempts with a 10-second timeout, waiting 2 seconds and then 4 seconds between tries. A 4xx response, such as 401 or 404, ends the retries at once, so return a 2xx status as soon as your endpoint has accepted the event.

Do webhooks fire for imported or bulk-edited testimonials?

No. testimonial.created fires when a customer submits a collection form or when a testimonial is created through the REST API. Approving, rejecting or deleting one testimonial at a time in the dashboard fires the matching event. Imports, manually added testimonials and bulk actions on several selected testimonials send no webhook.

Want to try this yourself?

The free plan includes 10 video testimonials, 20 text, a Wall of Love embed and CSV import. No credit card, and nothing expires.

Start free

Was this article helpful?