Webhooks

Webhooks let you connect Tenaxis to external tools and systems. When something important happens in Tenaxis (a site is provisioned, a request is approved, a risk alert fires), Tenaxis can automatically send a notification to a URL you specify - enabling you to integrate with Slack, Microsoft Teams, ServiceNow, Jira, Power Automate, Zapier, or any other system that accepts webhooks.

What Is a Webhook?

A webhook is an automatic notification that Tenaxis sends to another system when a specific event occurs. It works like this:

1. You tell Tenaxis: "When event X happens, send a message to this URL"
2. Event X happens in Tenaxis
3. Tenaxis sends an HTTP POST request with JSON data to your URL
4. Your system (Slack, ServiceNow, your custom script, etc.) receives the data and takes action

You don't have to poll Tenaxis for updates - Tenaxis pushes information to you the moment events happen.

Managing Webhooks

Go to Settings → Webhooks to see all webhooks registered in your workspace.

Registering a New Webhook

1. Click Add Webhook
2. Fill in:
   • URL - The endpoint that will receive the notification (must be HTTPS)
   • Events - Which events should trigger this webhook (see below)
   • Active - Leave checked to start receiving events immediately
3. Click Save

Tenaxis generates a secret key when the webhook is created. Copy and save this key immediately - it's only shown once. You'll use it to verify that notifications really came from Tenaxis.

Available Events

Choose which events trigger each webhook. You can subscribe to multiple events per webhook.

The Webhook Payload

When an event fires, Tenaxis sends a JSON POST to your URL with this structure:

{
  "event": "site.provisioned",
  "timestamp": "2026-05-31T14:22:00Z",
  "tenantId": "your-tenant-id",
  "data": {
    "siteId": "abc123",
    "siteName": "Marketing Project 2026",
    "siteUrl": "https://yourcompany.sharepoint.com/sites/marketing-project-2026",
    "createdBy": "jane.smith@yourcompany.com"
  }
}

The data object contains details relevant to the specific event type.

Verifying Webhook Authenticity

Every webhook request from Tenaxis includes a signature in the X-Tenaxis-Signature HTTP header. This allows your receiving endpoint to verify the message actually came from Tenaxis (and wasn't forged by someone else).

The signature is an HMAC-SHA256 hash of the request body, signed with your webhook's secret key.

To verify in your code:

1. Get the X-Tenaxis-Signature header value
2. Compute HMAC-SHA256 of the raw request body using your webhook secret
3. Compare the result to the header value
4. If they match - the request is authentic

Example verification (Node.js):

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

Testing a Webhook

Before relying on a webhook in production, test it:

1. Go to Settings → Webhooks
2. Click on the webhook you want to test
3. Click Send Test
4. Tenaxis sends a test payload to your URL
5. Check your endpoint (Slack channel, ServiceNow, etc.) to confirm it was received

Webhook Delivery Logs

Tenaxis keeps a log of every webhook delivery attempt, including successes and failures.

To view the delivery log:

1. Go to Settings → Webhooks
2. Click on a webhook
3. Click Delivery Log

The log shows:

Retrying a Failed Delivery

If a delivery failed (e.g., your endpoint was temporarily down), you can retry it:

1. Find the failed delivery in the log
2. Click Retry
3. Tenaxis resends the original payload to your endpoint

Common Integration Examples

Slack / Microsoft Teams Alert Channel

Use case: Alert your IT team in Slack when a site is flagged as high-risk or a request is submitted.

1. Set up an Incoming Webhook in your Slack workspace (or Teams channel)
2. Copy the Webhook URL Slack/Teams provides
3. In Tenaxis, add a new webhook with that URL
4. Subscribe to events: risk.high, request.submitted, lifecycle.escalated

Now your team gets a Slack/Teams message whenever one of these events happens.

ServiceNow / Topdesk Ticket Creation

Use case: Automatically create an IT ticket when a site is provisioned or when a high-risk site is detected.

1. Your ITSM tool should have an inbound webhook or API endpoint
2. Register that endpoint in Tenaxis as a webhook
3. Subscribe to site.provisioned and/or risk.high
4. Build an automation in your ITSM tool to parse the Tenaxis payload and create a ticket

Power Automate / Zapier

Use case: Connect Tenaxis events to any of hundreds of apps without writing code.

1. In Power Automate or Zapier, create a new "When a webhook is received" trigger
2. Copy the generated URL
3. Register it in Tenaxis as a webhook
4. Add actions in Power Automate/Zapier (e.g., create a Planner task, send an email, log to SharePoint list)

Editing and Deleting Webhooks

Edit a Webhook

1. Go to Settings → Webhooks
2. Click on the webhook
3. Click Edit
4. Update the URL, events, or active status
5. Click Save

Deactivate a Webhook

Instead of deleting a webhook you might need later, deactivate it:

1. Click Edit
2. Toggle Active to OFF
3. Click Save

The webhook remains in your list but won't receive any events until reactivated.

Delete a Webhook

1. Click on the webhook
2. Click Delete
3. Confirm

The webhook is permanently removed along with its delivery history.

Troubleshooting

Deliveries are failing with status 401 or 403: Your endpoint is rejecting the request due to authentication. Check if your endpoint requires an API key or authentication header - Tenaxis doesn't add these automatically. Consider using Power Automate or Zapier as an intermediary.

Deliveries are failing with status 500: Your endpoint is having an internal error. Check the logs on your receiving system.

No deliveries at all: Check that the webhook is marked as Active and that you've selected the right events.

Deliveries succeed but data looks wrong: Check the specific event field in the payload to make sure your code is handling the right event type.