Loading…
Loading…
The body and signature below are exactly what ERPNext would send for these sample values.
Webhook
Data · fields to send
{
"customer": "Metro Mart",
"grand_total": 33642.0,
"name": "SAL-ORD-2026-00087",
"status": "To Deliver and Bill"
}When: On Submit of a Sales Order. Sent in the background, retried up to 3 times. Add a Content-Type header in the Headers table if your receiver needs one.
{
"name": {{ doc.name | tojson }},
"customer": {{ doc.customer | tojson }},
"grand_total": {{ doc.grand_total | tojson }},
"status": {{ doc.status | tojson }}
}// Node (Express): verify the signature on the RAW body
const crypto = require("crypto");
app.post("/erpnext-hook", express.raw({ type: "*/*" }), (req, res) => {
const expected = crypto.createHmac("sha256", process.env.WEBHOOK_SECRET)
.update(req.body).digest("base64");
if (expected !== req.get("X-Frappe-Webhook-Signature")) return res.sendStatus(401);
const data = JSON.parse(req.body.toString("utf8"));
// … use data.customer, data.grand_total …
res.sendStatus(200);
});In Zapier
Start a Zap with “Webhooks by Zapier” → Catch Hook, and copy the URL it gives you.
In ERPNext
Create a Webhook: pick the DocType and Doc Event, paste the URL as the Request URL, choose the fields.
Test it
Save or submit a document. Zapier shows the data it caught; map the fields to your next step.
The same webhook works with Make, n8n or your own server. For the other direction, tools call ERPNext’s REST API with an API key and secret.
You do not need one for ERPNext to send data out. ERPNext’s built-in Webhook posts a document to any URL, and Zapier’s “Webhooks by Zapier” Catch Hook receives it.
On the document event you choose: after insert, on update, on submit, on cancel, on trash, on update after submit, on change, or a workflow transition. A condition can narrow it further.
ERPNext tries up to three times, waiting up to the timeout you set (5 seconds by default) each time, and records every attempt in the Webhook Request Log.
Turn on Enable Security and set a secret. ERPNext then sends an X-Frappe-Webhook-Signature header: a base64 HMAC-SHA256 of the body, which your server recomputes and compares.
Yes, through ERPNext’s REST API, using an API key and secret for a user with the right permissions.
We set up webhooks, API users and the automations around them, and make sure a failed call is noticed. Talk to a consultant.
or write to info@acube.co
Kochi (Kadavanthra & Infopark) · Thiruvananthapuram · across India & overseas · In business since 2011