CRM
Salesforce Webhooks
Enterprise CRM platform. Receive events for records, platform events, and workflow triggers.
Connecting Salesforce to Hookbase
Create a source in Hookbase first — it gives you an ingest URL to paste into Salesforce. Then:
- 1Option A: in Setup → Process Automation → Outbound Messages, create a New Outbound Message with your Hookbase ingest URL as the Endpoint URL
- 2Trigger it from a record-triggered Flow (Action: Outbound Message) on the object you want to watch
- 3Note: Hookbase does not yet return the SOAP <Ack>true</Ack> that Salesforce expects, so Salesforce will retry each Outbound Message for up to 24 hours
- 4Option B (recommended for now): use a Flow HTTP Callout or an Apex callout that POSTs JSON to your Hookbase ingest URL
- 5There is no secret to paste into Hookbase, because Salesforce does not sign these requests
Signature verification
Salesforce does not sign its webhooks with an HMAC scheme, so a signing secret on the source would have nothing to verify. Use a custom source with no secret, and keep the ingest URL itself hard to guess.
How Salesforce secures them instead: Salesforce classic Outbound Messages do not support HMAC signatures. Salesforce's own guidance: restrict the listener to Salesforce's published IP ranges, require TLS, optionally validate Salesforce's client certificate (mutual TLS), and check that the payload's OrganizationId matches your org (an identifier, not a secret).
Salesforce event types
6 of the events people route most often. Hookbase accepts every event Salesforce sends, whether or not it is listed here.
Account.created
Custom (Flow/Apex): an Account record was created
Account.updated
Custom (Flow/Apex): an Account record was updated
Contact.created
Custom (Flow/Apex): a Contact record was created
Lead.created
Custom (Flow/Apex): a Lead record was created
Opportunity.updated
Custom (Flow/Apex): an Opportunity record was updated (e.g. StageName changed)
Case.created
Custom (Flow/Apex): a Case record was created
What a Salesforce webhook looks like
A Opportunity.updated payload. Hookbase stores the raw body exactly as it arrived, so this is also what you get back on a replay.
{
"event_type": "Opportunity.updated",
"organization_id": "00D5e000000AbCdEAF",
"occurred_at": "2024-01-15T10:30:00.000Z",
"record": {
"Id": "0065e00000AbCdEAAV",
"Name": "Enterprise Deal Q1",
"StageName": "Closed Won",
"Amount": 75000,
"CloseDate": "2024-01-15",
"AccountId": "0015e00000XyZaBAAX",
"OwnerId": "0055e00000LmNoPAAV",
"LastModifiedDate": "2024-01-15T10:30:00.000Z"
}
}Start receiving Salesforce webhooks
Create a source, paste the URL into Salesforce, and watch the first event arrive. The free tier includes 1,000 events a month.
Get Started Free