Overview
The Endpoint URL is the internet address that PulseGrid will call when a matching event happens.
It is not:
- your PulseGrid dashboard address
- a normal website homepage
- the WebSocket URL shown in Channel Console
- a random URL that does not accept POST requests
It must point to a backend route designed to receive an HTTP POST request.
Production example:
https://api.yourcompany.com/webhooks/pulsegrid/
In that example:
- https://api.yourcompany.com is the receiving company's backend domain.
- /webhooks/pulsegrid/ is a route implemented by its developers.
- That route reads the raw request body, verifies the signature, handles the event, and returns a 2xx response.
Temporary test example:
https://webhook.site/11c0b827-698b-4389-b305-94a4ba93267e
Webhook.site creates a temporary inbox and gives you a unique URL. Copy the unique URL displayed on Webhook.site, not the address from another person's example.
Setup
For testing with Webhook.site:
1. Visit https://webhook.site/ in a separate browser tab.
2. Copy the unique URL shown at the top of your temporary inbox.
3. In PulseGrid, open Webhooks and select your project.
4. Click Add endpoint.
5. Name: Webhook.site test
6. Endpoint URL: paste your unique Webhook.site URL.
7. Events: *
8. Create the endpoint.
9. Click Send test.
10. Return to Webhook.site and look for the new POST request.
For local backend testing, PulseGrid may use HTTP while DEBUG=True. Example receiver URL when PulseGrid runs on port 8000 and your receiving backend runs separately on port 9000:
http://127.0.0.1:9000/webhooks/pulsegrid/
Production endpoints must use HTTPS.
Code example
POST /webhooks/pulsegrid/ HTTP/1.1
Host: api.yourcompany.com
Content-Type: application/json
X-PulseGrid-Event: order.created
X-PulseGrid-Delivery: 5199d768-e076-4977-aa56-7d1e3e868ef8
X-PulseGrid-Timestamp: 1787686026
X-PulseGrid-Signature: v1=...
{
"event": "order.created",
"data": {
"order_id": "ORD-1042"
}
}
Notes
The receiver should respond quickly. Return HTTP 200 or another 2xx response after safely accepting the event.
Do not expose the webhook signing secret in browser JavaScript, mobile applications, URLs, screenshots, or public repositories. Keep it in the receiving backend's environment variables.