Set up webhooks
A webhook lets your own systems react to what happens in Declara — a new alert, a case opening, a deadline reminder — without polling the API. This page covers registering an endpoint and verifying that a delivery actually came from Declara. For what each event means and what its payload contains, see the webhook event catalog.
Before you start
You need the owner or an admin role, on a plan that includes integrations. Have an
HTTPS endpoint ready that can accept a POST request and return a 2xx status within
ten seconds. A delivery that times out or gets a temporary error is retried for about
ten hours; see the event catalog for the schedule.
Steps
- Open Settings → Integrations and choose Signed webhook.
- Give it a name and enter your endpoint URL.
- Press Connect. Every event in the event catalog is delivered; there is no per-event filter in the interface, so ignore the events you don't need on your side.
- Declara generates a signing key for this endpoint; it's used to sign every delivery, and isn't shown again after creation, the same way an API key's secret isn't.
- Press Test to send one delivery to this endpoint specifically, without posting to any other configured integration.
An Article 14 drill never delivers anything, so a practice case cannot reach a system that would treat it as real.
Verifying a delivery is genuine
Every delivery carries a timestamp and a signature computed over that timestamp and the raw body, using your endpoint's signing key. Recompute the same signature on your end and compare it before trusting the payload — the full mechanics, including the exact headers and the HMAC construction, are in the webhook event catalog. Reject anything where the timestamp is too old to guard against a replayed request.
What you should see
A delivery log per integration showing whether each attempt was delivered or failed, with the response status or error recorded — so an endpoint that's quietly stopped working shows up as failing rather than looking healthy by default.