Developer ToolsFree generatorPDF, Excel, Word export

Webhook Payload Template Generator for ERP Events

Webhooks let an ERP tell other systems or AI agents that something changed instead of being polled. A good payload is small, versioned, identifiable and verifiable. This generator produces one with matching headers and receiver rules.

Fill in

Event type

Event id

Occurred at (UTC)

Source system

Record id

New status

Previous status

Tracking number

Record URL

Generated code

Free, optional. Reopen it on any device.

Download:

Payload (HTTP POST body)

{
  "id": "evt_01JB8Q2X9K",
  "type": "sales_order.shipped",
  "version": "2026-10-01",
  "occurredAt": "2026-10-20T09:15:30Z",
  "source": "erp-prod-us",
  "data": {
    "id": "SO-100245",
    "status": "shipped",
    "previousStatus": "picked",
    "trackingNumber": "1Z999AA10123456784",
    "url": "https://erp.example.com/api/v1/sales-orders/SO-100245"
  }
}

Headers to send

Content-Type: application/json
X-Webhook-Id: evt_01JB8Q2X9K
X-Webhook-Timestamp: 2026-10-20T09:15:30Z
X-Webhook-Signature: sha256=<hex HMAC of timestamp + "." + raw body using the shared secret>

Receiver rules

1. Verify the signature against the raw body before parsing.
2. Reject timestamps older than five minutes.
3. Store the event id and ignore duplicates.
4. Return 2xx quickly and process asynchronously.
5. Fetch the full record from data.url if you need more fields.

The header names and signature scheme here are a design pattern, not a standard. Match whatever your platform defines if you are consuming someone else's webhooks. Keep payloads small and put sensitive detail behind an authenticated fetch.

Design my ERP event flow

Optional: we can review webhook contracts and build the receivers and agents behind them.

Optional. The tool and every export work without this. No spam.

Was this tool useful?

How to use it

Name the event in noun.verb form, supply the record id and the fields that changed, and generate the body and headers. Use the output as the contract between the sender and every receiver. Share it with downstream teams, and have them implement the five receiver rules. Export it to Word or PDF to attach to an integration design document.

Use a stable, unique event id
Include a schema version in every payload
Send the new and previous status for state changes

Design reasoning

The event id supports idempotency, because delivery is usually at least once and receivers must tolerate duplicates. The occurredAt field and a signed timestamp defend against replay. An HMAC signature over the raw body proves the sender knows the secret. A version field lets you evolve fields without breaking consumers. A url to the record keeps the payload thin, since ERP records can be large and sensitive.

Using webhooks with AI agents

An agent can subscribe to events such as a purchase order approval or a quality hold and then decide what to do, rather than polling every few minutes. Keep the action behind the same permission and approval rules as any other tool. The payload should carry ids and states, not free text from users, so that injected instructions in data fields cannot steer the model.

Common mistakes

Frequent errors include missing event ids, parsing the body before checking the signature, doing long work before replying so the sender retries, ordering assumptions between events, and putting full records with personal or controlled data in the payload. Document retry behavior and what a receiver should do on repeated failure.

Frequently Asked Questions

Should the payload carry the full record?

Usually no. Send ids, the changed fields and a url. Receivers can fetch the full record with their own credentials, which keeps payloads small and avoids leaking data to endpoints that do not need it.

How do I handle duplicate deliveries?

Store the event id when you process it and skip any event you have already seen. Most webhook systems guarantee at least once delivery, so duplicates are normal.

What is the signature for?

It lets the receiver confirm the request came from the sender and was not changed. Compute an HMAC with a shared secret over the raw body and timestamp, then compare in constant time.

Is the header format a standard?

No. Names and schemes differ between vendors. This template is a sensible pattern; follow the documented format of any platform whose webhooks you consume.

Netray builds event driven integrations and agents on ERP data. If you want a design review of your webhook contract, get in touch.

Talk to an Expert Explore More Free Tools