Add a webhook endpoint

A webhook is TrackMyVendor calling your system when something happens, instead of your system asking us. It's how everything else here — Zapier, Make, Slack, Teams — actually works underneath.

1. 1

   Open Settings → Integrations

   Settings → the Integrations tab → Webhook Endpoints.

2. 2

   Add the endpoint

   Label — for you, so a list of three endpoints is legible in a year. "Make scenario", "Slack #compliance".

   URL — where we POST. Must be HTTPS.

3. 3

   Choose events

   Tick the Events you want. Subscribe to what you'll act on, not everything — an endpoint firing on events nobody handles is noise you'll eventually stop reading.

4. 4

   Save and copy the secret

   Save. The signing secret is shown once. Copy it now — you need it to verify deliveries, and it can't be shown again.

The five events

What we send

A POST with a JSON body:

{
  "id": "evt_4f1c9a2b7d3e8f0a1b2c3d4e",
  "event": "contractor.compliance_changed",
  "created_at": "2026-09-03T14:05:11Z",
  "data": {
    "contractor": {
      "id": 412,
      "name": "Ridgeline Electric",
      "email": "office@ridgeline.example",
      "compliance_status": "not_compliant",
      "compliance_reasons": ["The certificate from Travelers expired Sep 1, 2026"],
      "url": "https://trackmyvendor.com/app/vendors/412",
      ...
    },
    "from": "compliant",
    "to": "not_compliant"
  }
}

Every event carries the full contractor, so you don't have to look them up. The rest of data depends on the event: from and to for a status change; expiration_date, days_left and window for anything expiring, with the license or certificate it's about.

A status is one of compliant, not_compliant or no_documents — the same as the badge on the contractor's page.

And four headers:

• X-TMV-Event — the event type
• X-TMV-Event-Id — the event's id, the same on every attempt
• X-TMV-Delivery — this attempt, for matching it to the delivery log
• X-TMV-Signature — proof it came from us

When a delivery fails

• Anything other than a 2xx is retried, three attempts in all. Each one appears in the endpoint's delivery log.
• A 410 Gone is taken to mean the URL is finished with: the endpoint is switched off instead of retried. Switch it back on from the same list.
• An address on a private network — localhost, 10.x, 192.168.x and the like — is refused when you save it, and never sent to.

What happens next