A webhook integration for everything else

Every report event leaves as a signed HTTP POST to a URL you choose. Point it at Zapier, at Make, at an n8n workflow, or at code of your own, and the answer to "do you integrate with X" stops depending on whether we built X.

Install ExtensionAdd a webhook destination

What a webhook sends

One JSON body per event, signed, with the report behind a link rather than in the payload.

A destination is a URL. When something happens to a report on a domain the destination is bound to, we POST a JSON body to that URL with a content type of application/json and a user agent of SessionReplay-Webhooks. The body names the event, the payload version, the report and the site it came from.

Three headers travel with it. X-Session-Replay-Event repeats the event name so you can branch before parsing, X-Session-Replay-Delivery identifies the attempt, and X-Session-Replay-Signature carries the unix timestamp as t and the digest as v1, an HMAC-SHA256 over the timestamp, a full stop and the raw body, computed with the signing secret. Recompute it and compare, and reject anything whose timestamp is more than five minutes old.

If your endpoint is down, the delivery is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, which is six attempts in all. Any 2xx counts as success. Connect and read both time out after five seconds, and every attempt is written to the delivery log on the destination.

Exactly what the Test button sends
{
  "event": "report.created",
  "version": 1,
  "test": true,
  "sent_at": "2026-09-01T06:02:21Z",
  "data": {
    "report": {
      "id": "00000000-0000-0000-0000-000000000000",
      "share_token": "test-delivery-not-a-real-report",
      "share_url": "https://session-replay.com/replays/test-delivery-not-a-real-report",
      "status": "pending",
      "severity": "minor",
      "created_at": "2026-09-01T06:02:21Z",
      "updated_at": "2026-09-01T06:02:21Z"
    },
    "site": {
      "id": "00000000-0000-0000-0000-000000000000",
      "domain": "example.com"
    }
  }
}

The events you can subscribe to

Five, and you tick the ones you want when you add the destination.

A report arrives

Sent as report.created, when somebody finishes a capture on one of your domains. This is the one most automations are built on.

The status moves

Sent as report.status_changed, when a report goes from pending to in progress, resolved or rejected. Useful for closing whatever your automation opened.

The severity changes

Sent as report.severity_changed. A minor report promoted to critical is often the moment you want to page somebody, and it is rarely the moment it was filed.

Somebody opens it for the first time

Sent as report.first_viewed, once per report. It answers whether the link you forwarded was ever looked at.

A report is sent on

Sent as report.sent, when a report is handed to a destination. It is how one automation can react to another one firing.

Subscribing an endpoint

Four steps on the Connectors screen, and the first delivery you see is one you asked for.

Add the URL

A team admin opens Connectors and adds a destination URL. It has to be HTTPS and it has to resolve publicly, so an address on your own machine is refused when you save it.

Choose the events

All five are ticked when the form opens. Untick the ones your automation would only have to filter out again.

Bind it to your domains

One claimed domain, several of them, or all of them. A destination bound to one domain never hears about the others.

Copy the secret and press Test

The signing secret is shown once, in a modal, when the destination is created, and can be rotated later. Copy it somewhere safe, then press Test and read the delivery log.

Verifying the signature is a few lines in any language: take the t and v1 values out of the header, recompute the HMAC-SHA256 over the timestamp, a full stop and the raw request body, and compare. The Connectors screen shows a worked example against your own destination once it exists. If you want to watch a delivery arrive before you write a receiver at all, point the destination at the webhook test endpoint and press Test.

Do you integrate with Zapier, Make or n8n?

Yes, through the generic incoming webhook each of them already has. You paste a URL, and there is nothing to install at either end.

Zapier

Start a Zap with the Webhooks by Zapier trigger, take the Catch Hook URL it gives you, and add it as a destination here. Branch on the event field in a Paths step.

Make

Add a Custom webhook module, copy the address it generates, and paste it in as a destination. Make reads the structure from the first delivery, so press Test while it is listening.

n8n

Drop in a Webhook node, set it to POST, and use its production URL as the destination. A Switch node on the event field gives you one branch per event.

Or code of your own

Any HTTPS endpoint you can deploy. Verify the signature, read the event field, and do whatever your team actually needs, without waiting for a connector to exist.

What this does not do

A webhook is a signed POST and nothing more. So there is no confusion about what subscribing one gets you:

  • No app in anybody's directory. There is nothing published in Zapier's, Make's or n8n's app catalogue, because the connection is their generic webhook trigger and a URL you paste. Nothing is installed at their end or at ours.
  • The body is our JSON schema, not a chat message. Pointed straight at a Discord or Teams incoming webhook it will not render as a message. Slack and Microsoft Teams have connectors of their own, on the connectors page.
  • The capture is never in the body. What travels is the report's identity, its domain, its status, its severity and its share link. The screen, the console output and the network log stay behind that link.
  • Nothing is read back and nothing syncs. Closing the ticket your automation created does not change the report, and neither does anything else that happens at your end.
  • Outbound only, to public HTTPS hosts. A plain HTTP URL or an address on a private network is refused when you save it, so a receiver on your laptop needs a tunnel.
  • A destination belongs to the team, not to a person. A team admin sets it up once and it is the whole team's, rather than something each member subscribes separately.

Questions people ask about webhooks

A URL of yours that we POST to. Every time something happens to a report on a domain you have claimed - it arrives, its status moves, its severity changes, somebody opens it for the first time, or it is sent on - we send a JSON body to that URL naming the event, the report and the site. The capture itself stays behind the share link in the body rather than travelling in it.

Through the generic incoming webhook each of them already has, so there is nothing to install at either end. In Zapier that is the Catch Hook URL from Webhooks by Zapier, in Make it is a Custom webhook module, and in n8n it is a Webhook node set to POST. Paste whichever URL you get in as a destination here, then branch on the event field.

Every request carries an X-Session-Replay-Signature header holding a timestamp as t and a digest as v1. Recompute an HMAC-SHA256 over the timestamp, a full stop and the raw request body using the destination's signing secret, compare it with v1, and reject anything whose timestamp is more than five minutes old. The Connectors screen shows the same thing worked through against your own destination.

The delivery is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, which is six attempts in all, and any 2xx response counts as a success. Connecting and reading both time out after five seconds. Every attempt is written to the delivery log on the destination, so a failing endpoint is something you can look at rather than something you have to notice.

Yes. Point a destination at the throwaway endpoint at /tools/webhook-test, press Test on the destination, and read the request that arrives, headers and all. It is a way of seeing the shape of the body and the signature before you have anywhere of your own for them to go.

Send your bug reports wherever you want them

Add a URL, tick the events, and the reports your team files start arriving in whatever you already automate with.

Install ExtensionSee pricing