Skip to content
Docs
Open Mammoth
Learn › Get data in › Webhooks: open the docs menu

Secure a Mammoth webhook and check its deliveries

A new webhook has no secret: anyone with the URL can add rows. You can require an X-SECRET header, limit which sites can post, and check every post in Recent deliveries on the dataset's Webhook card. The secret is under Settings & history > Settings in the dataset's panel (see Dataset settings and history).

Require a secret on the webhook

A new webhook has no secret: anyone with the URL can add rows. To require one:

  1. In the dataset's panel, open Settings & history, then Settings.
  2. Next to Secure header, choose Enabled.

Mammoth makes a 12-character secret and shows it beside the control as "(X-SECRET: ...)". The Webhook card then shows it under Secret.

Choose Disabled to remove the secret. Turning it off and on again makes a new secret, and the old one stops working at once, so update your sender straight away.

What the URL answers

  • 200 once it has taken the request, before anything is added to the dataset.
  • 200 even when it turns a post away for a wrong secret or a site it does not allow. Check Recent deliveries rather than the status code.
  • 404 for an unknown URL, or for a webhook in a workspace that is no longer active.

Check deliveries and turned-away posts

The card shows the webhook's state, Waiting, Receiving or Failing, with the time of the last row and how many arrived today.

Click Recent deliveries to see the latest 10 posts, each marked Received or Turned away with its time:

  • A received post shows the start of what was sent.
  • A test row is tagged test.
  • A turned-away post shows the reason.

Mammoth turns a post away, and adds nothing from it, when:

  • the X-SECRET header is wrong or missing;
  • it was sent from a site this webhook does not allow.

When posts are turned away, the card leads with how many and why, for example "3 posts turned away today: wrong or missing X-SECRET. Nothing from them was added.", with a See them link. The first post turned away each day also sends the project a notification naming the webhook and the reason. See Notifications.

Limit which sites can post to the webhook

By default a webhook takes posts from any site. A post from a browser carries an Origin header, and you can limit the webhook to a list of origins through the API. Set origins to a comma-separated list of origins exactly as browsers send them, for example https://shop.example.com,https://forms.example.com, or to * for any site:

curl -X PATCH "https://app.mammoth.io/api/v2/workspaces/<workspace_id>/projects/<project_id>/webhooks/<webhook_id>" \
  -H "Authorization: Bearer $MAMMOTH_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"patch": [{"op": "replace", "path": "origins", "value": "https://shop.example.com"}]}'

A post from another origin is turned away. A request with no Origin header, such as one from a server, is not checked against the list.

Was this page helpful?

Something wrong? support@mammoth.io