WebEquipe Webhook Manager

Watch: Full Plugin Walkthrough

WebEquipe Webhook Manager captures events from forms, WooCommerce, and any WordPress action hook, then delivers normalized JSON (or form-encoded) payloads to one or more webhook endpoints you define.

It is built around two concepts:

• Connections — reusable destinations. You set a URL, method, content type, and how to authenticate. Extra headers, Advanced HMAC options, and More settings stay on the same screen.
• Webhooks — rules that map a trigger (a form submission, a WooCommerce event, or a WordPress action hook) to one or more connections, with optional payload shaping and conditions.

Key features

• Triggers: form submissions (Contact Form 7, WPForms, Fluent Forms, Formidable Forms, Ninja Forms), WooCommerce events, and any WordPress action hook (with an on-demand hook picker).
• Payload shaping: send all fields, pick a subset, or remap field keys; add static fields as name/value rows; apply per-field transforms from a type dropdown.
• Conditional delivery: only send when field conditions match (AND/OR), using field and operator dropdowns.
• Authentication on each connection:
  • None — URL is enough (many catch hooks).
  • Bearer / JWT token — sends Authorization: Bearer … (paste the token or JWT; do not type Bearer yourself).
  • Username and password — two fields; sends HTTP Basic (Authorization: Basic …). Use this for n8n Basic Auth.
  • Sign each request — HMAC with a signing secret and a signature pattern.
  • Header-style API keys (for example n8n Header Auth) — Auth → None, then put the exact header name and value under Extra headers.
• Signature patterns (WebEquipe default, Timestamp + signature, Sign the raw body, Timestamp + prefixed signature, Custom) fill Extra headers when needed. Rename header names there to match your API. Pattern labels are generic.
• Help is a document with worked curl examples. See example on the connection screen shows a sample request.
• Delivery logging with request/response capture, replay, and CSV export.
• Dashboard with delivery stats and recent activity.
• Secrets (auth tokens, signing secrets) are encrypted at rest.

This plugin does not connect to any WebEquipe service. It only sends data to the endpoints you configure.

Getting Started

1. Create a connection. Webhook Manager → Connections → Add Connection.
   • Enter a name and the destination URL (a request-bin URL is fine for testing). Set method and content type.
   • Choose How should we authenticate?
     • None — for open URLs, or when you will send a custom header under Extra headers (n8n Header Auth: exact name + value).
     • Bearer / JWT token — paste the API token or JWT in Auth Token.
     • Username and password — fill Username and Password (n8n Basic Auth). The plugin Base64-encodes them for HTTP Basic.
     • Sign each request — pick a signature pattern and paste the signing secret (shared HMAC key, not a header).
   • Patterns that need headers (for example Timestamp + signature) fill Extra headers with values like {{unix}} and {{hmac}}. Rename the left-column names to match your API (for example X-Relava-Timestamp). Use Insert token for other tokens. Do not set Content-Type here.
   • Click See example (eye) for a sample on this screen. Click More in Help (book) for worked curl examples.
   • Save, keep it Active, and use Test Connection if you want. Check Request/Response: a 401/403 with www-authenticate: Basic means the endpoint wants Username and password, not a raw Authorization Extra header.
2. Create a webhook. Webhook Manager → Webhooks → Add Webhook.
   • Step 1: name the webhook.
   • Step 2: choose a trigger (Form submission, WooCommerce event, WordPress action hook, or Manual). WordPress action hook is a list of built-in events. Manual can type any hook or use Choose hook to scan installed plugins.
   • Steps 3–5 unlock after fields are known (immediately for WooCommerce and built-in WordPress events; after the first real delivery for most forms).
   • Payload: All fields, Pick fields, or Map & rename. Static fields are name/value rows (Add field). Transforms: pick a field, pick a type (lowercase, prefix, date format, …); a parameter appears only when that type needs one. Conditions: field, operator, and value (Add condition). Each of these has See example / More in Help and an optional Edit as text fallback.
   • Step 6–8: choose one or more connections, set delivery options, and enable the webhook.
3. Test it. Use Send Test on the webhook (or Test Connection on the connection). Connection Test sends a small sample (event + data.test), not a real form lead — a 422 from an API that requires name/email can still mean the URL and signature were accepted. Then fire the real event and review Logs.

Troubleshooting

• Test says “could not reach the server”. Verify the URL is correct and reachable from your server (from Docker/local WordPress, localhost is the container — use host.docker.internal to reach an API on your Mac). Check the Logs screen for the captured response.
• 401 / 403 Authorization data is wrong. Match the auth mode to the destination: Basic realm responses need Username and password; Header Auth needs Extra headers with the exact name/value; Bearer/JWT needs Bearer / JWT token.
• No log entries appear. Confirm the webhook is enabled, the trigger/source matches the event, and at least one connection is selected.
• GET requests. A request body is not sent with GET/HEAD requests; use POST/PUT/PATCH to send a body.
• Deliveries are slow. Reduce the connection timeout, or enable asynchronous delivery in Settings.

Privacy

This plugin stores and transmits data that may include personal information:

• Delivery logs may contain submitted form field values (which can include names, email addresses, and other personal data), the request URL, request/response headers, and request/response bodies. Some triggers (for example Contact Form 7) may include the submitter’s IP address and user agent.
• Outbound payloads are sent to the third-party endpoints you configure. The contents and the receiving party are entirely under your control.
• Stored secrets (authentication tokens and HMAC signing secrets) are encrypted at rest.

You control retention via the log retention setting, and you can permanently remove all plugin data on uninstall by enabling “Remove all data on uninstall” in Settings before deleting the plugin. Because payloads are delivered to external services that you choose, review those services’ privacy practices and disclose them in your own site’s privacy policy as needed.

Third-Party Services

This plugin does not bundle or call any predefined third-party service. It transmits data only to the webhook endpoint URLs that the site administrator configures. You are responsible for the terms and privacy policy of any endpoint you send data to.