All integrations
Outbound webhooks
OUT — POST /api/webhooks, POST /api/webhooks/:id/test
Some workflows do not want to poll for data. They want to be told. Dynamite Docs outbound webhooks POST an extraction.completed event to your endpoint the moment an extraction finishes, signed with HMAC-SHA256 so you can verify it came from us. Up to five endpoints per account, with automatic retries for anything that looks transient.
Try it free or read the API & webhooks docs.
Polling is a tax on both sides of the integration
- Scripts that poll for new extractions burn requests and lag by the poll interval. Nobody wants their document pipeline to be as stale as the last cron run.
- An unauthenticated webhook is a spoofing hole. Anyone can POST a fake event, and a receiver that trusts it acts on data that never existed.
- Transient failures (a 429, a 5xx, a network blip) should be retried, not dropped. A lost event is a silent data gap.
- Webhook payloads that are not signed leave the receiver guessing whether the event is real.
How webhooks work
01 — Register an endpoint
Create a webhook with an HTTPS URL, up to five per account. Endpoints are validated as public URLs (SSRF-guarded) so the service never posts to internal addresses.
02 — Get the secret
Your webhook secret is shown once at creation and used to verify signatures. You confirm the endpoint by its signature. Nothing is trusted on the URL alone.
03 — Receive the event
When an extraction completes, we POST the extraction.completed payload with columns, rows, metadata, and confidence, signed in the X-Dynamite-Signature header.
04 — Verify and retry
Verify the HMAC-SHA256 signature over the raw body before acting. Network errors, 429s, and 5xx retry with exponential backoff and jitter, up to three attempts.
The webhook surface
A small, safe, verifiable event surface:
- Event — extraction.completed
- Endpoints — up to 5 per account
- Signature — HMAC-SHA256 in X-Dynamite-Signature
- Payload — columns, rows, metadata, confidence
- Retries — backoff + jitter, 3 attempts, 10s timeout
- SSRF guard — public URLs only, internal targets rejected
- Test button — POST /api/webhooks/:id/test
A realistic example
The payload your endpoint receives and how to verify it:
| Field | Example | Purpose |
|---|
| event | extraction.completed | Tells the receiver what happened |
| data.columns | ["Invoice #", "Date", "Total"] | The table headers |
| data.rows | [["INV-2041", "2026-06-03", "1240.00"]] | The extracted rows |
| data.confidence | 0.97 | Average confidence of the extraction |
| X-Dynamite-Signature | hmac-sha256 hex digest | Proof the event is genuine |
Events are how document pipelines stop polling
A document workflow that waits for data has two options: poll until it shows up, or get told when it shows up. Webhooks are the second. A webhook pipeline reacts in the moment the extraction completes; a polling pipeline lags by the length of its poll interval. For a system that moves extracted rows into a ledger or a downstream approval flow, the event is the trigger everything else hangs on.
Signature verification is the security line in the sand. The payload is signed with HMAC-SHA256 over the raw body, and the secret is shown to you once at creation. A receiver that verifies the signature before acting knows the event is genuine. No amount of URL trust can substitute for that. The verification snippet is a few lines in any language with an HMAC implementation, and it is the difference between consuming real events and being spoofed by anyone who can POST to your endpoint.
Retry behavior is where delivery gets honest. Webhook delivery retries on network errors, HTTP 429s, and 5xx with exponential backoff and jitter, up to three attempts with a per-attempt timeout. That is a deliberate contract. Transient failures are retried, and the small number of attempts keeps a permanently broken endpoint from hammering it forever. Endpoints are also SSRF-guarded, so the service will not POST to internal or non-public URLs. A receiving server never sees a request it was not meant to get.
The same event can also act as a workflow trigger in your own systems, firing a Slack alert or appending to a database. The test endpoint lets you exercise delivery without waiting for a real extraction, which makes the initial wiring a five-minute job instead of a debug session.
What webhooks do and do not
Does
- POST extraction.completed events to your HTTPS endpoints with an HMAC-SHA256 signature over the raw body.
- Retry transient failures (network, 429, 5xx) with exponential backoff and jitter, up to three attempts.
- Reject non-public/internal target URLs to keep delivery SSRF-safe.
Does not
- Does not send the full document bytes. Webhooks carry the extracted data, not the file.
- Does not retry forever: three attempts max, so a broken endpoint cannot be hammered.
- Does not deliver to endpoints that cannot verify the signature. Verification is the receiver’s job, and the secret is shown once.
Why webhooks complete the outbound story
Push beats poll. An event the moment extraction completes means your downstream systems act in real time, not on the last cron run.
HMAC signing makes delivery verifiable. The receiver can prove an event is genuine before trusting a single field.
Retries with backoff and an SSRF guard make the contract reliable and safe, so the webhook channel can be trusted for production traffic.
Questions, answered
What does a webhook event contain?
The extraction.completed payload: columns, rows, metadata, docType, and confidence. It carries the extracted data, not the source document bytes.
How do I verify the signature?
Compute HMAC-SHA256 over the raw request body using your webhook secret and compare it to the X-Dynamite-Signature header with a constant-time comparison.
How many endpoints can I have?
Up to five per account. Each has its own secret and can be tested independently from the workspace.
What happens if delivery fails?
Network errors, 429s, and 5xx retry with exponential backoff and jitter, up to three attempts with a per-attempt timeout.
Document workflows it feeds
Open app, no payment details.