Send every response where it needs to go.

What a webhook delivery looks like

Every completed response is sent as a POST request with a JSON body. Each answer carries the question’s id, the reference you set, its type and title, the raw value and a readable text version, so your code can use whichever it needs.

{
  "event": "response.completed",
  "form": { "id": "f_…", "title": "Customer feedback" },
  "response": {
    "id": "r_…",
    "submitted_at": "2026-10-05T09:41:00.000Z",
    "duration_ms": 48210,
    "score": null,
    "hidden": { "utm_source": "newsletter" },
    "answers": [
      { "question_id": "…", "ref": "name", "type": "short_text", "title": "What’s your name?", "value": "Ada", "text": "Ada" }
    ]
  }
}

How to verify a webhook signature

Each request has an x-forms-signature header in the form t=<timestamp>,v1=<signature>. The signature is an HMAC-SHA256, in hex, of the timestamp, a full stop and the raw request body, keyed with your endpoint’s secret. Recompute it and compare before you trust the body. Checking that the timestamp is recent also stops old requests being replayed.

import crypto from "node:crypto";

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto.createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  const given = Buffer.from(parts.v1 ?? "");
  return fresh && given.length === expected.length && crypto.timingSafeEqual(Buffer.from(expected), given);
}

Use the raw body exactly as received. Parsing and re-serialising the JSON changes the bytes and the signature won’t match.

Retries and duplicates

If your endpoint doesn’t answer with a success status, Forms tries again with growing gaps, starting at 30 seconds and doubling up to an hour, for up to five attempts in total. Every request also carries an x-forms-delivery header that stays the same across retries, so you can ignore a delivery you’ve already processed.

Zapier, Make and n8n without code

• Zapier: create a Zap with “Webhooks by Zapier” and the “Catch Hook” trigger, copy its URL into Forms, and submit a test response.
• Make: add a “Custom webhook” module, copy the address into Forms, and let Make learn the structure from a test response.
• n8n: add a Webhook node set to POST, paste its production URL into Forms, and activate the workflow.
• From there, send each response to a CRM, Slack, a calendar, an email tool or a database.