Webhooks

A webhook sends an automatic HTTP request to an address you choose whenever a ticket in EnaFeedback is routed or changes status. Your own work-order system, status board or internal app hears about the change straight away.

This article covers setting up the webhook, the events it sends, and how to verify with the signature that a request really came from EnaFeedback.

Required roleCopy Anchor Link

The webhook setting lives under System settings → Integrations and only the Owner role can change it.

Events sentCopy Anchor Link

Two business events are sent today:

There is also a system.test event you can send from the settings page.

Delivery behaviorCopy Anchor Link

• There is one webhook URL per organization.
• Each request is a POST with a JSON body.
• Each event is sent in a single attempt; failed requests are not retried.
• Every request carries an Idempotency-Key header. Store it so you never process the same event twice.
• If you set a signing secret, the HMAC-SHA256 signature of the body is sent in the X-Ena-Signature header.
• The target URL passes a safety check that blocks requests to internal network addresses (SSRF protection).
• There are no per-event subscriptions; once a URL is set, all of the events above are sent.

Set up the webhookCopy Anchor Link

Verify the signatureCopy Anchor Link

The signature is the HMAC-SHA256 of the raw request body, computed with your signing secret. Use the body exactly as received, without parsing and re-serializing the JSON, and compare in constant time.

The examples below assume the signature is sent as a hex string. Check the header format on the test event before you go live.

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.ENA_WEBHOOK_SECRET;

app.post('/ena-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const received = req.get('X-Ena-Signature') ?? '';
  const expected = crypto.createHmac('sha256', SECRET).update(req.body).digest('hex');

  const ok =
    received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  const idempotencyKey = req.get('Idempotency-Key');
  // Skip the event if idempotencyKey was already processed.
  const event = JSON.parse(req.body.toString('utf8'));
  // Handle the event…
  res.status(200).end();
});

TipsCopy Anchor Link

• With no retries, keep your endpoint fast: store the request, return 200 at once, and do heavy work in the background.
• If an event is ever missed, check the ticket's current status in the admin panel.
• When you rotate the signing secret, update the receiving side at the same time.

LimitsCopy Anchor Link

• There is no public REST API and no API keys; the webhook is the only outbound integration point.
• There are no ready-made connectors for n8n, Make or Zapier.
• There are no per-event subscriptions and no retries.

Related articlesCopy Anchor Link

• Notification channels
• Alert rules
• System settings
• Ticket lifecycle