Webhooks

A webhook sends an HTTP POST to your endpoint when an event happens in your Doris workspace. Each workspace can have up to 10 webhooks. A webhook subscribes to one or more event patterns.

Webhooks are not offered. The Doris app has no webhook settings, so you cannot add a webhook yourself. Webhooks that already exist continue to deliver. To change or remove one, contact support@meetdoris.com.

Rules for the endpoint

The URL must use HTTPS.
The URL must not point to a private, internal or metadata address. Doris checks this when you create the webhook and again before each delivery.
Your endpoint must reply within 10 seconds.
A 2xx status means the delivery succeeded. Doris ignores the response body.

Events

A pattern is an event type or a glob. For example, deal.* matches every event whose type starts with deal..

Event type	When Doris sends it
`meeting.processed`	Doris finished processing a meeting.
`deal.created`	A deal was created.
`deal.stage_changed`	A deal moved to a different stage.
`deal.updated`	A CRM webhook reported a created or updated deal.
`deal.closed`	A deal closed.
`deal.review_completed`	Doris finished a review of a deal.
`commitment.created`	Doris recorded a new commitment.
`commitment.overdue`	A commitment passed its due date.
`flow.completed`	A flow run completed.

deal.* also matches other deal. events, for example deal.meeting_processed and deal.stakeholder_changed. Doris does not send events that come from a personal flow run. Events from workspace flow runs are sent.

Payload

Every delivery is a JSON object with these keys:

Key	Always present	Description
`event_id`	Yes	The event ID.
`event_type`	Yes	The event type, for example `deal.stage_changed`.
`timestamp`	Yes	The time of the event, in ISO 8601.
`entity`	Yes	`{"type": ..., "id": ...}` of the object the event is about.
`changes`	No	`{field: {"old": ..., "new": ...}}` when the event records one changed field.
`data`	No	Event data. The keys depend on the event type.
`context`	No	Extra metadata of the event.

Example: stage change from a CRM

A CRM stage change records the field stage_name.

{
  "event_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "event_type": "deal.stage_changed",
  "timestamp": "2026-09-18T14:30:00+00:00",
  "entity": {
    "type": "deal",
    "id": "5590756e-c2e2-50f9-ba17-0f8dcee493bd"
  },
  "changes": {
    "stage_name": {
      "old": "Discovery",
      "new": "Negotiation"
    }
  },
  "data": {
    "deal_id": "5590756e-c2e2-50f9-ba17-0f8dcee493bd",
    "pipeline_id": "default",
    "amount": 285000,
    "stage": "Negotiation",
    "previous_stage": "Discovery"
  }
}

Example: meeting processed

{
  "event_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "event_type": "meeting.processed",
  "timestamp": "2026-09-18T15:00:00+00:00",
  "entity": {
    "type": "meeting",
    "id": "039e66a3-15ee-5988-aca0-02f4829230d9"
  },
  "data": {
    "meeting_id": "039e66a3-15ee-5988-aca0-02f4829230d9",
    "user_id": "7d0c2a8e-1b4f-4c5e-9a3d-2f6b8e1c0d9a",
    "title": "Apex weekly sync",
    "linked_deal_ids": ["5590756e-c2e2-50f9-ba17-0f8dcee493bd"],
    "linked_deal_count": 1,
    "system_call_type": null,
    "system_call_type_confidence": null,
    "suppress_emails": false,
    "skip_deal_review": false
  }
}

`data` keys for each event

Event type	`data` keys
`meeting.processed`	`meeting_id`, `user_id`, `title`, `linked_deal_ids`, `linked_deal_count`, `system_call_type`, `system_call_type_confidence`, `suppress_emails`, `skip_deal_review`
`deal.created`	`deal_id`, `deal_name`, `amount`, `stage`
`deal.stage_changed`	`deal_id`, `pipeline_id`, `amount`, `stage`, `previous_stage`
`deal.updated`	`deal_id`, `action` (`created` or `updated`), `changed_fields`
`deal.closed`	`deal_id`, `is_won`, `amount`
`deal.review_completed`	`entity_count`, `user_id`, `deal_name`, `risk_count`, `highest_severity`, `stakeholder_count`, `trigger`
`commitment.created`	`description`, `owner_type`, `due_date`, `deal_id`, `source_meeting_id`
`commitment.overdue`	`description`, `due_date`, `days_overdue`, `deal_id`
`flow.completed`	`flow_run_id`, `node_count`

A key can be missing or null when the source did not supply it. Only HubSpot fills changed_fields on deal.updated.

Headers

Header	Value
`Content-Type`	`application/json`
`X-Doris-Signature`	`sha256=` and the HMAC-SHA256 of the raw body, in hex
`X-Doris-Event`	The event type
`X-Doris-Delivery`	The delivery ID. It stays the same on each retry of a delivery.

Verify the signature

Each webhook has a signing secret that starts with whsec_. Doris shows the secret once, when you create the webhook. Compute the HMAC-SHA256 of the raw request body with the secret as the key. Compare the result with X-Doris-Signature.

import hashlib
import hmac


def verify_signature(body: bytes, signature_header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

const crypto = require('crypto');

function verifySignature(body, signatureHeader, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Use the raw body bytes. If you parse the JSON and serialize it again, the signature does not match. Signature checks are optional. A tool such as n8n, Power Automate or Zapier can accept the JSON body without a check.

Retries

Doris makes up to 3 attempts for each delivery.

Attempt	When
1	When the event happens
2	About 1 minute after attempt 1 fails
3	About 5 minutes after attempt 2 fails

A timeout, a network error or a status that is not 2xx counts as a failure. After attempt 3 fails, the delivery stops. If the URL points to a blocked address at delivery time, the delivery fails at once, with no retry. A job checks for due retries every 60 seconds, so a retry can come up to a minute late.

Test event

A test sends this body to your endpoint, with the X-Doris-Signature and X-Doris-Event headers. A test has no X-Doris-Delivery header.

{
  "event_id": "test-000",
  "event_type": "test.ping",
  "timestamp": "2026-05-05T00:00:00Z",
  "entity": { "type": "test", "id": "ping" },
  "data": { "message": "Webhook test from Doris console" }
}

Get started

Using Doris

Automation

Admin & integrations

Developers

Changelog

Rules for the endpoint

Events

Payload

Example: stage change from a CRM

Example: meeting processed

`data` keys for each event

Headers

Verify the signature

Retries

Test event

​Rules for the endpoint

​Events

​Payload

​Example: stage change from a CRM

​Example: meeting processed

​data keys for each event

​Headers

​Verify the signature

​Retries

​Test event

Rules for the endpoint

Events

Payload

Example: stage change from a CRM

Example: meeting processed

`data` keys for each event

Headers

Verify the signature

Retries

Test event