Integration Details

Webhooks

Push every submission to a URL you control, the moment it arrives.

Talk to us

Overview

A webhook is the simplest way to connect Monival to something else: you give a form a URL, and Monival sends an HTTP POST to that URL each time the form receives a submission.

It is configured per form, not per organisation, so different forms can drive different downstream processes without any routing logic on your side.

The payload

Monival sends a JSON body over POST with Content-Type: application/json:

{
  "event": "submission.created",
  "formId": "...",
  "submissionId": "...",
  "organizationId": "...",
  "submittedAt": "2026-07-14T09:31:02.184Z",
  "syncSource": "mobile",
  "answers": { }
}
  • event — currently only submission.created is dispatched.
  • syncSource — distinguishes submissions that came from the web, the mobile app, or an offline queue that synced later.
  • answers — the submitted answers keyed by question.

Setting one up

  1. Stand up an endpoint that accepts POST and returns quickly.
  2. Open the form’s settings in Monival and set the webhook URL.
  3. Submit a test entry and confirm the payload arrives.

If you do not want to build an endpoint, point the webhook at a Power Automate HTTP trigger and use its connector library instead. That is the route most organisations take, and it is why Power Automate is the integration we lead with.

Delivery behaviour, stated plainly

These are the real characteristics of the dispatch, and they should shape what you build on it:

  • At-most-once delivery. One attempt per submission. There is no retry, no queue, and no dead-letter.
  • 5-second timeout. An endpoint that does not respond within five seconds may not complete the delivery. Acknowledge fast and process asynchronously.
  • Failures do not block the submission. If the webhook cannot be delivered, the submission is still saved normally and the failure is logged on the Monival side. Your data is never at risk from a webhook problem — but a downstream notification can be silently missed.
  • No HMAC signature. The payload is not cryptographically signed. Treat the webhook URL itself as the secret: use HTTPS, include an unguessable path segment or token in the URL, and validate it on receipt.
  • No IP allowlist is published for outbound dispatch, so URL secrecy is the control available to you.

Design accordingly

Webhooks here are excellent for notification, alerting and convenience automation, and are not the right mechanism for a guaranteed pipeline into a system of record.

If a downstream system must have every submission:

  • Use the webhook for the fast path — immediate notification and low-latency processing.
  • Reconcile on a schedule against the Power BI / Excel data feed, which is a pull interface and is authoritative.

That two-path pattern costs very little to build and removes the class of problem where a five-second timeout during a network blip turns into a missing record nobody notices for a month.