A webhook integration for everything else
Every report event leaves as a signed HTTP POST to a URL you choose. Point it at Zapier, at Make, at an n8n workflow, or at code of your own, and the answer to "do you integrate with X" stops depending on whether we built X.
What a webhook sends
One JSON body per event, signed, with the report behind a link rather than in the payload.
A destination is a URL. When something happens to a report on a domain the destination is bound to, we POST a JSON body to that URL with a content type of application/json and a user agent of SessionReplay-Webhooks. The body names the event, the payload version, the report and the site it came from.
Three headers travel with it. X-Session-Replay-Event repeats the event name so you can branch before parsing, X-Session-Replay-Delivery identifies the attempt, and X-Session-Replay-Signature carries the unix timestamp as t and the digest as v1, an HMAC-SHA256 over the timestamp, a full stop and the raw body, computed with the signing secret. Recompute it and compare, and reject anything whose timestamp is more than five minutes old.
If your endpoint is down, the delivery is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, which is six attempts in all. Any 2xx counts as success. Connect and read both time out after five seconds, and every attempt is written to the delivery log on the destination.
{
"event": "report.created",
"version": 1,
"test": true,
"sent_at": "2026-09-01T06:40:45Z",
"data": {
"report": {
"id": "00000000-0000-0000-0000-000000000000",
"share_token": "test-delivery-not-a-real-report",
"share_url": "https://session-replay.com/replays/test-delivery-not-a-real-report",
"status": "pending",
"severity": "minor",
"created_at": "2026-09-01T06:40:45Z",
"updated_at": "2026-09-01T06:40:45Z"
},
"site": {
"id": "00000000-0000-0000-0000-000000000000",
"domain": "example.com"
}
}
}The events you can subscribe to
Five, and you tick the ones you want when you add the destination.
A report arrives
Sent as report.created, when somebody finishes a capture on one of your domains. This is the one most automations are built on.
The status moves
Sent as report.status_changed, when a report goes from pending to in progress, resolved or rejected. Useful for closing whatever your automation opened.
The severity changes
Sent as report.severity_changed. A minor report promoted to critical is often the moment you want to page somebody, and it is rarely the moment it was filed.
Somebody opens it for the first time
Sent as report.first_viewed, once per report. It answers whether the link you forwarded was ever looked at.
A report is sent on
Sent as report.sent, when a report is handed to a destination. It is how one automation can react to another one firing.
Subscribing an endpoint
Four steps on the Connectors screen, and the first delivery you see is one you asked for.
Add the URL
A team admin opens Connectors and adds a destination URL. It has to be HTTPS and it has to resolve publicly, so an address on your own machine is refused when you save it.
Choose the events
All five are ticked when the form opens. Untick the ones your automation would only have to filter out again.
Bind it to your domains
One claimed domain, several of them, or all of them. A destination bound to one domain never hears about the others.
Copy the secret and press Test
The signing secret is shown once, in a modal, when the destination is created, and can be rotated later. Copy it somewhere safe, then press Test and read the delivery log.
Verifying the signature is a few lines in any language: take the t and v1 values out of the header, recompute the HMAC-SHA256 over the timestamp, a full stop and the raw request body, and compare. The Connectors screen shows a worked example against your own destination once it exists. If you want to watch a delivery arrive before you write a receiver at all, point the destination at the webhook test endpoint and press Test.
Do you integrate with Zapier, Make or n8n?
Yes, through the generic incoming webhook each of them already has. You paste a URL, and there is nothing to install at either end.
Zapier
Start a Zap with the Webhooks by Zapier trigger, take the Catch Hook URL it gives you, and add it as a destination here. Branch on the event field in a Paths step.
Make
Add a Custom webhook module, copy the address it generates, and paste it in as a destination. Make reads the structure from the first delivery, so press Test while it is listening.
n8n
Drop in a Webhook node, set it to POST, and use its production URL as the destination. A Switch node on the event field gives you one branch per event.
Or code of your own
Any HTTPS endpoint you can deploy. Verify the signature, read the event field, and do whatever your team actually needs, without waiting for a connector to exist.
What this does not do
A webhook is a signed POST and nothing more. So there is no confusion about what subscribing one gets you:
- No app in anybody's directory. There is nothing published in Zapier's, Make's or n8n's app catalogue, because the connection is their generic webhook trigger and a URL you paste. Nothing is installed at their end or at ours.
- The body is our JSON schema, not a chat message. Pointed straight at a Discord or Teams incoming webhook it will not render as a message. Slack and Microsoft Teams have connectors of their own, on the connectors page.
- The capture is never in the body. What travels is the report's identity, its domain, its status, its severity and its share link. The screen, the console output and the network log stay behind that link.
- Nothing is read back and nothing syncs. Closing the ticket your automation created does not change the report, and neither does anything else that happens at your end.
- Outbound only, to public HTTPS hosts. A plain HTTP URL or an address on a private network is refused when you save it, so a receiver on your laptop needs a tunnel.
- A destination belongs to the team, not to a person. A team admin sets it up once and it is the whole team's, rather than something each member subscribes separately.
Questions people ask about webhooks
Send your bug reports wherever you want them
Add a URL, tick the events, and the reports your team files start arriving in whatever you already automate with.