Webhooks

Pactbase pushes consent and rights-request events to your systems (CRM, mailing list, an n8n workflow) as they happen. Example: when a person withdraws consent for the newsletter, your mailing list hears about it within seconds and stops emailing them.

Webhooks push each change. The API lets your systems pull consent when they choose, for example a nightly sync, or a check right before sending. Use either or both.

Events

What is sent and when.

Payload settings

Filter purposes and forms, hash emails.

Verify a webhook

Check the signature, answer fast.

Delivery and retries

Backoff, resend and ordering.

Security and retention

What is stored, and for how long.

Add an endpoint

Settings, then Webhooks, then Add endpoint. Only admins can change endpoints. Members can see endpoints and deliveries.

Field	What to enter
Endpoint URL	Your receiver's `https://` URL, reachable from the internet (for example an n8n Webhook node's production URL). Private and internal addresses are refused, and redirects are not followed
Description	Optional, for you: "CRM sync (n8n)"
Events to send	Tick what the receiver needs. Default: consent updated and consent withdrawn
Signing secret	Leave empty and Pactbase generates one (`whsec_...`). Or paste your own in the same format: `whsec_` and at least 16 bytes in base64
Custom headers	Optional, up to 5. Sent with every request, for example `X-N8N-Auth: a-long-random-value` for n8n's Header Auth, or `Authorization: Bearer ...`. Values are stored encrypted and never shown again. Leave a value blank on an edit to keep it
Send events to this endpoint	Switches it on or off without deleting it

After Add endpoint, the signing secret is shown once with a Copy button. Put it in your receiver's configuration. Later, from Edit:

Show secret reveals the current secret (admins).
Change secret makes a new generated secret, or uses the one you type. The old one stops working at once, so update your receiver right after.

Every endpoint card has:

Send test event: sends a webhook.test event straight away and shows what came back, for example "Test event delivered: HTTP 200 in 84 ms".
Deliveries: the last 50 deliveries, each with its status, HTTP answer, attempts and the exact body sent, with Resend.
Switch on or off, Edit and Delete. Deleting an endpoint keeps its delivery log summaries for their retention period.

Adding, editing, deleting and changing a secret are recorded in the Audit Log. The in-app guide (How to receive webhooks) repeats the receiver steps.

What a request looks like

POST to your URL, with Content-Type: application/json and User-Agent: Pactbase-Webhooks/1.0:

{
  "id": "msg_2b7f4c0e9a6d4f1c8e3a5b7d9f1c3e5a",
  "type": "consent.withdrawn",
  "timestamp": "2026-10-11T09:30:12.512Z",
  "org_id": "6643fca5-...",
  "data": { }
}

Header	Value
`webhook-id`	The event id (`msg_...`). The same on every retry and resend, and for every endpoint that gets the event. Store it and ignore repeats
`webhook-timestamp`	Unix seconds when this attempt was signed
`webhook-signature`	`v1,` followed by a base64 HMAC-SHA256 signature. See Verify a webhook
Your custom headers	As configured

This is the Standard Webhooks format, so its libraries (and Svix's) verify it as they are.