Webhooks
Webhook integration

Webflow Webhooks: Send Form and Publish Events to Sazabi

By Sazabi Team

Webhook facts checked on the platform’s docs on Nov 8, 2026.

A Webflow webhook tells another system when something happens on a site: someone submits a form, you publish, a CMS item changes, an order comes in. This page covers what Webflow sends and how to keep those events in Sazabi.

What Webflow sends

Each webhook listens to one trigger type. The documented types include form_submission, site_publish, page_created, page_metadata_updated, page_deleted, ecomm_new_order, ecomm_order_changed, ecomm_inventory_changed, collection_item_created, collection_item_changed, collection_item_deleted, collection_item_published, collection_item_unpublished and comment_created.

The request is a POST with a JSON body in two parts. triggerType names the event, and payload holds the event data. Unlike platforms that put the event name in a header, Webflow puts it in the body, so one Sazabi URL can take several trigger types and you can still tell them apart.

Why send it to Sazabi

Form submissions and publishes are the moments a marketing site changes in ways that matter to engineers. A broken form, a publish that landed just before a traffic dip or a flood of submissions all show up as events. Sazabi's Webhook Events source stores each JSON payload as a searchable log record, with the data under webhook.* attributes, next to your other logs.

A path suffix such as /webflow is stored as webhook.path. If you want one stream per site, include the site in the suffix, for example /webflow/marketing-site.

Set it up in Webflow

  1. Open Site settings, then Apps and integrations, then Webhooks.
  2. Select Add webhook.
  3. Choose a trigger type, such as Form submission or Site publish.
  4. Choose the API version, v1 or v2.
  5. Paste your Sazabi intake URL with a suffix as the webhook URL.
  6. Save, then trigger the event: submit the form or publish the site.

Repeat for each trigger type. Webflow allows up to 75 webhooks for a single trigger type. The form submission trigger also accepts a filter with a form name when you create it through the API, which helps if one site has many forms.

Example payload

An abbreviated form submission using the field names in the Webflow docs. It is an example, not a captured delivery.

{
  "triggerType": "form_submission",
  "payload": {
    "name": "Contact Us",
    "siteId": "65427cf400e02b306eaa049c",
    "data": { "First Name": "Zaphod", "email": "zaphod@heartofgold.ai" },
    "submittedAt": "2024-07-30T20:07:15.220Z",
    "id": "66a947f35b9d7ba400e22733",
    "formId": "65429eadebe8a9f3a30f62d7"
  }
}

In a Sazabi thread, search for a top-level field such as webhook.triggerType to isolate one kind of event.

Submitted form data lands in Sazabi as written, so a contact form with email addresses or phone numbers stores those values. Decide whether that fits before you point a form at it.

What to watch for

  • Strict success rule. Webflow counts anything other than a valid HTTP 200 as a failure. Redirects, certificate problems and timeouts count too. After your first test, check that Sazabi doesn't hold repeated records for the same submission id, which would mean Webflow saw failures and retried.
  • Deactivation. If Webflow keeps hitting failures it deactivates the webhook and emails you. Recovery goes through Webflow support, so catch a failing webhook early.
  • Duplicates. After retries one event can arrive more than once. The payload id is the identifier to compare.
  • Gaps after a deactivation. Quiet form events during a busy week are a reason to check the webhook before the form.
  • Publish noise. site_publish events include a publishScope of site or page, so a page-level publish can look like a full release unless you read it.

The Intake page in the Sazabi dashboard shows ingestion volume per source, which makes a drop easy to spot.

Retries

Webflow expects a 200 response. Otherwise it retries up to three more times, at an interval of ten minutes, and then stops. Its limits table lists 75 webhooks per trigger type and three retry attempts. Webflow also signs requests with x-webflow-signature when you create webhooks through the API, but not for dashboard webhooks. Webflow signs a timestamp, a colon and the body.

Teams that run forms elsewhere can send Typeform responses the same way, and store events can come from Shopify.

Webflow webhook facts

Signatures: Sazabi doesn’t verify Webflow requests and doesn’t reject unsigned ones. Webflow signs a timestamp, a colon and the body, a format none of Sazabi’s signature options covers, and webhooks created in the dashboard aren’t signed. The Webhook Events source accepts any JSON POST to your intake URL, so the intake URL is the only credential. It’s hard to guess, so keep it private, and rotate the project’s public key if it leaks.

  • Events: The event list includes form_submission, site_publish, page_created, ecomm_new_order, collection_item_created, collection_item_changed and comment_created, among others. (Webflow docs, accessed Nov 8, 2026)
  • Payload: When an event occurs Webflow sends a POST request with a JSON body and a Content-Type header of application/json, where the body holds a triggerType and a payload object. (Webflow docs, accessed Nov 8, 2026)
  • Signing: Requests carry x-webflow-timestamp and x-webflow-signature headers, but webhooks created through the dashboard do not include the headers needed to validate signatures. (Webflow docs, accessed Nov 8, 2026)
  • Retries: If the response status is anything other than 200, Webflow retries the webhook up to three more times, ten minutes apart, and then treats it as failed. (Webflow docs, accessed Nov 8, 2026)

Frequently Asked Questions

Does Webflow send webhooks as JSON?

Yes. Webflow sends a POST request with a Content-Type of application/json. The body has a triggerType field and a payload object.

Where do I create a Webflow webhook without code?

In Site settings, open Apps and integrations, then Webhooks, and select Add webhook. Choose a trigger type, an API version and a URL.

How often does Webflow retry a failed webhook?

Webflow retries up to three more times, ten minutes apart, when it gets anything other than a 200 response. After repeated failures it deactivates the webhook and emails you.

Are dashboard webhooks signed?

No. Webflow says webhooks created through the dashboard lack the headers needed to validate signatures. Webhooks created through the API are signed over a timestamp, a colon and the request body.

Does Sazabi verify Webflow signatures?

No. Webflow signs a timestamp, a colon and the body, a format none of Sazabi’s signature options covers, and webhooks created in the dashboard aren’t signed. Sazabi doesn’t reject unsigned requests, so keep the intake URL private: it’s the only credential.

Sources

  1. Webhook requests, event types, signature headers, failure conditions, retry limits, deactivation and the 75 webhooks per trigger type limit (accessed Nov 8, 2026)
  2. Form submission payload fields: triggerType, payload name, siteId, data, schema, submittedAt, id and formId (accessed Nov 8, 2026)
  3. Site publish payload fields: siteId, publishedOn, domains, publishedBy, publishScope and pageId (accessed Nov 8, 2026)
  4. Creating a webhook in the dashboard under Site settings, Apps and integrations, Webhooks (accessed Nov 8, 2026)
  5. Webhook Events source: JSON only, payload under webhook.* attributes, path suffix stored as webhook.path; signature verification with the Standard Webhooks and Custom HMAC options, and rejected deliveries (accessed Nov 8, 2026)