Webhooks

Requires: Fundations Pro 1.1.0+

Sends an HTTP request to a URL of your choice when a Fundations event occurs. Use this to connect to Make, n8n, Pabbly Connect, a custom API, or any other service that accepts HTTP callbacks.

Why use it

Webhooks give you full control over where event data goes and how it is processed. Unlike the named integrations, webhooks do not require a specific platform. Any endpoint that can receive an HTTP POST or PUT request can receive Fundations data.

What it does

When a configured trigger fires, the connector sends an HTTP request to the configured URL with a JSON body (or form-encoded body, if configured). The request includes a flat payload of event data.

If a secret key is set, two additional headers are added to every request:

• X-Webhook-Secret:
• X-Webhook-Signature:

Use the signature header to verify that requests originate from your site.

All non-localhost URLs must use HTTPS. HTTP is only accepted for localhost, 127.0.0.1, ::1, and *.local hostnames. Private and reserved IP ranges are blocked to prevent server-side request forgery.

Supported triggers

Trigger key	Fires when
action_created	A new fundation is published
action_updated	A fundation is edited and saved
action_completed	A fundation reaches its goal
donation_received	A donation payment is confirmed (requires marketing consent)
donation_failed	A donation payment fails
user_registered	A new user registers via the wizard
campaign_joined	A user joins a campaign
team_created	A new team is created
milestone_reached	A fundation hits 25%, 50%, or 75% of its goal

How to set it up

1. Navigate to Fundations Pro → Integrations → Webhooks.
2. Enter the Webhook URL (must be HTTPS for non-local endpoints).
3. Select the HTTP Method: POST (default) or PUT.
4. Select the Content Type: JSON (default) or form-encoded.
5. Optionally enter a Secret Key to enable HMAC signature verification.
6. Optionally add Custom Headers, one per line in Header-Name: value format.
7. Select which Triggers should fire this webhook.
8. Click Test to send a sample payload to your endpoint and verify it is received.
9. Enable the integration.

To send the same event to multiple endpoints, create multiple automation rules, each pointing to a different webhook instance.

Settings & options

Setting	Type	Description
Webhook URL	URL	The endpoint that receives the request. HTTPS required for public URLs
HTTP Method	Select	POST or PUT. Default: POST
Content Type	Select	json or form. Default: json
Secret Key	Password (encrypted)	If set, adds X-Webhook-Secret and X-Webhook-Signature headers
Custom Headers	Textarea	Additional headers, one per line, format: Header-Name: value

Payload format

The request body is a JSON object with a flat data object. There are no nested sub-objects for donor, campaign, or payment.

{
  "trigger": "donation_received",
  "timestamp": "2026-06-12T10:00:00+00:00",
  "data": {
    "donation_id": 123,
    "donation_amount": 50.0,
    "donation_currency": "EUR",
    "donor_email": "jan@example.com",
    "donor_first_name": "Jan",
    "donor_last_name": "de Vries",
    "payment_method": "ideal",
    "action_id": 456,
    "action_title": "Spring Fundraiser",
    "action_url": "https://yoursite.com/fundation/spring-fundraiser/",
    "marketing_consent": true
  }
}

For milestone_reached, the data object also contains "milestone": 50 (integer: 25, 50, or 75).

For action_created on a guest-created fundation, data also contains "claim_url": "https://yoursite.com/claim/?token=...". This is useful if you want to send the claim link via an external email tool.

For donation_failed, data also contains "error": "".

See Integration index: Data Payload for the full field reference.

What you can and cannot do

You can:

• Send event data to any HTTPS endpoint.
• Choose between JSON and form-encoded bodies.
• Add custom authentication headers (API keys, Bearer tokens, etc.).
• Verify request authenticity using the HMAC signature header.
• Send to multiple endpoints using multiple automation rules.

You cannot:

• Use HTTP for public endpoints (only localhost/local hostnames).
• Send requests to private IP ranges (SSRF protection is enforced).
• Configure automatic retries (there is no built-in retry logic). Failed calls are logged and can be retried manually from the Sync Logs screen.
• Send nested/structured payloads; the data is always flat key-value pairs.

Examples

Make / n8n automation: Create an HTTP module in Make or n8n that accepts a POST request. Enter that URL here, select donation_received. Your automation receives flat donor and donation fields for each confirmed donation.

Custom backend notification: Point the webhook at your own API endpoint. Use the secret key and verify the X-Webhook-Signature header server-side before processing.

Milestone alert: Select milestone_reached as the trigger. Your endpoint receives the milestone field (25, 50, or 75) and can trigger a celebration email or social media post.

Guest claim link delivery: Select action_created. When a guest creates a fundation, the payload includes claim_url. Forward this to an external email service to send the claim link.

Troubleshooting

Problem	Likely cause	Fix
Test button fails with SSL error	Self-signed certificate on endpoint	Use a valid SSL certificate for the receiving server
Requests not received	Endpoint uses HTTP on a public URL	Switch to HTTPS
Signature verification failing	Secret key mismatch	Confirm the key in Fundations settings matches what your endpoint uses for verification
No data for donation_received	Donor did not give marketing consent	The trigger only fires when consent is true
Failed syncs in logs	Endpoint returned a non-2xx response	Check your endpoint logs; use the retry button in Sync Logs
Payload fields missing	Trigger does not include those fields	Check the Data Payload reference

Developer reference

Verifying the HMAC signature

When a secret key is configured, every request includes these headers:

X-Webhook-Secret: your-secret-key
X-Webhook-Signature: hex-encoded-HMAC-SHA256

To verify in PHP:

$body      = file_get_contents( 'php://input' );
$secret    = 'your-secret-key';
$expected  = hash_hmac( 'sha256', $body, $secret );
$received  = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

if ( ! hash_equals( $expected, $received ) ) {
    http_response_code( 403 );
    exit;
}

Filtering outgoing data

add_filter( 'get_fund_integration_trigger_data', function( $data, $trigger, $object_id ) {
    // Remove sensitive fields before they leave your server
    unset( $data['donor_email'] );
    return $data;
}, 10, 3 );

See Integration index developer reference for all available filters.