A webhook is TrackMyVendor calling your system when something happens, instead of your system asking us. It's how everything else here — Zapier, Make, Slack, Teams — actually works underneath.
-
Open Settings → Integrations
Settings → the Integrations tab → Webhook Endpoints.
-
Add the endpoint
Label — for you, so a list of three endpoints is legible in a year. "Make scenario", "Slack #compliance".
URL — where we POST. Must be HTTPS.
-
Choose events
Tick the Events you want. Subscribe to what you'll act on, not everything — an endpoint firing on events nobody handles is noise you'll eventually stop reading.
-
Save and copy the secret
Save. The signing secret is shown once. Copy it now — you need it to verify deliveries, and it can't be shown again.
The five events
| Event | Fires when |
|---|---|
contractor.created | A contractor is added. |
contractor.compliance_changed | Their status changes. The one most people want. |
contractor.license_expiring | A licence is approaching expiry. |
contractor.coi_expiring | A certificate is approaching expiry. |
contractor.w9_missing | No W-9 on file. |
What we send
A POST with a JSON body:
{
"event": "contractor.compliance_changed",
"created_at": "2026-09-03T14:05:11Z",
"data": { ... }
}And three headers:
X-TMV-Event— the event typeX-TMV-Delivery— a unique id for this deliveryX-TMV-Signature— proof it came from us
Careful
X-TMV-Delivery to recognise a repeat rather than acting on it again.
What happens next
Anything reachable by URL can receive one, but you don't have to write the receiver yourself: connect Zapier or Make.