> AI agents: this is one page from Mammoth Analytics documentation. The index of all pages as Markdown is https://mammoth.io/docs/llms.txt. Append `.md` to any docs URL, or send `Accept: text/markdown`, to get Markdown.

# Secure a Mammoth webhook and check its deliveries

> Require an X-SECRET header on a Mammoth webhook, limit which sites can post to it, read Recent deliveries, and see why a post was turned away.
>
> Applies to: Where: Data Library › dataset panel › Settings & history › Settings › Secure header

A new [webhook](https://mammoth.io/docs/learn/get-data-in/webhooks/) has no secret: anyone with the URL can add rows. You can require an `X-SECRET` header, limit which sites can post, and check every post in **Recent deliveries** on the dataset's **Webhook** card. The secret is under **Settings & history** > **Settings** in the dataset's panel (see [Dataset settings and history](https://mammoth.io/docs/learn/organise/dataset-settings/)).

## Require a secret on the webhook

A new webhook has no secret: anyone with the URL can add rows. To require one:

1. In the dataset's panel, open **Settings & history**, then **Settings**.
2. Next to **Secure header**, choose **Enabled**.

Mammoth makes a 12-character secret and shows it beside the control as "(X-SECRET: ...)". The **Webhook** card then shows it under **Secret**.

Choose **Disabled** to remove the secret. Turning it off and on again makes a new secret, and the old one stops working at once, so update your sender straight away.



## What the URL answers

- `200` once it has taken the request, before anything is added to the dataset.
- `200` even when it turns a post away for a wrong secret or a site it does not allow. Check **Recent deliveries** rather than the status code.
- `404` for an unknown URL, or for a webhook in a workspace that is no longer active.

## Check deliveries and turned-away posts

The card shows the webhook's state, **Waiting**, **Receiving** or **Failing**, with the time of the last row and how many arrived today.

Click **Recent deliveries** to see the latest 10 posts, each marked **Received** or **Turned away** with its time:

- A received post shows the start of what was sent.
- A test row is tagged **test**.
- A turned-away post shows the reason.

Mammoth turns a post away, and adds nothing from it, when:

- the `X-SECRET` header is wrong or missing;
- it was sent from a site this webhook does not allow.

When posts are turned away, the card leads with how many and why, for example "3 posts turned away today: wrong or missing X-SECRET. Nothing from them was added.", with a **See them** link. The first post turned away each day also sends the project a notification naming the webhook and the reason. See [Notifications](https://mammoth.io/docs/learn/automate/notifications/).

## Limit which sites can post to the webhook

By default a webhook takes posts from any site. A post from a browser carries an `Origin` header, and you can limit the webhook to a list of origins through the API. Set `origins` to a comma-separated list of origins exactly as browsers send them, for example `https://shop.example.com,https://forms.example.com`, or to `*` for any site:

```bash
curl -X PATCH "https://app.mammoth.io/api/v2/workspaces/<workspace_id>/projects/<project_id>/webhooks/<webhook_id>" \
  -H "Authorization: Bearer $MAMMOTH_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"patch": [{"op": "replace", "path": "origins", "value": "https://shop.example.com"}]}'
```

A post from another origin is turned away. A request with no `Origin` header, such as one from a server, is not checked against the list.

## Related

- [Receive data in Mammoth with a webhook](https://mammoth.io/docs/learn/get-data-in/webhooks/): create the webhook and send data.
- [Dataset settings and history](https://mammoth.io/docs/learn/organise/dataset-settings/): where **Secure header** lives.
- [Notifications](https://mammoth.io/docs/learn/automate/notifications/): the alert for turned-away posts.
- [Connect a database or app](https://mammoth.io/docs/learn/get-data-in/connect-a-source/): the Connectors launcher and its **Push** group.

---
Source: https://mammoth.io/docs/learn/get-data-in/webhook-security.md · Updated: 2026-11-08