Webhooks

Where: Settings → Webhooks. The Webhooks settings card only appears once a webhook has been configured for your company by the Vouch team.

"Receive events from Vouch at your endpoint. Your webhook secret is hidden by default; you can reveal it and copy it when needed."

Webhooks push a real-time event from Vouch to your own server or automation platform (Zapier, n8n, etc.) when a candidate is hired — or when their start date changes.

Why use a webhook

A webhook is how Vouch tells another system that something happened, the instant it happens — no polling, no manual export. It's the building block for "when we hire someone, automatically…" flows: kick off onboarding, create the new hire in your HR system, post to a channel, update a spreadsheet. Vouch fires the event; your automation does the rest.

When you'd reach for one

• You want a hire in Vouch to trigger onboarding or HRIS provisioning automatically.
• You're wiring Vouch into a no-code tool (Zapier, n8n) and need a real-time trigger.
• A start-date change needs to ripple out to a downstream system or calendar.

Webhooks are configured by the Vouch team. If you need one set up, contact support@vouch.careers.

Your webhook configuration

Each webhook shows:

Field	Notes
Event types	Chips showing which events this webhook listens to
Endpoint URL	The URL Vouch posts to
Secret	Hidden by default. Click the eye icon to reveal; copy icon to copy.

Good to know. Treat the Secret like a password — it's what lets your server prove an incoming request really came from Vouch (see Webhook security below). Reveal it only when you need to wire it into your endpoint, and store it somewhere safe.

Edit a webhook

Click the edit (pencil) icon → Edit Webhook modal → update the Endpoint URL → Save. Toast: "Webhook updated successfully."

Editing here changes where events are delivered — handy when you move from a staging endpoint to production, or your automation tool hands you a new URL. The events the webhook listens to are part of how it was set up; if you need to change which events fire, that's a change the Vouch team makes.

Test a webhook

Click Test Webhook to send a mock event payload to the endpoint. Toast: "Mock webhook sent successfully."

Use Test Webhook right after you point a webhook at a new URL — it sends a representative payload so you can confirm your endpoint receives it, parses it, and verifies the signature, all without waiting for a real hire to happen.

Empty state: "No webhooks configured. Contact support if you need help setting up webhooks."

Webhook security

Vouch signs every webhook payload. Verify the signature using the x-vouch-signature header (HMAC-SHA256 with your webhook secret). The documentation tab on the page shows:

• TypeScript Type — the exact shape of the ON_HIRE event payload.
• Signature Verification — a Node.js code snippet for validating the signature.

Always verify the signature before trusting a payload. Your endpoint URL could be guessed or leaked; the signature is what proves a request genuinely came from Vouch and wasn't tampered with in transit. The check is simple: compute the HMAC-SHA256 of the raw request body using your webhook secret, and compare it to the x-vouch-signature header. If they don't match, drop the request.

Troubleshooting — signatures don't match. The most common cause is hashing the parsed body instead of the raw request body. Compute the HMAC over the exact bytes Vouch sent, before any JSON parsing or re-serialisation reorders or reformats it. Also confirm you're using the current Secret from this page — if it was rotated, an old secret will fail every check.

Troubleshooting — the test event never arrives. Make sure your endpoint is reachable from the public internet and answers with a 2xx quickly. A local URL, an endpoint behind auth that blocks Vouch, or one that's slow to respond can all cause Test Webhook to look like nothing happened.