HTTP / Webhook
Deliver events to any HTTP endpoint with custom headers, auth, timeouts, and optional outbound HMAC signing.
The http provider posts events to any HTTP endpoint. This is the most common destination type — use it for your own APIs, Slack, Discord, PagerDuty, Zapier, Linear, Datadog, or anything that accepts an HTTP webhook.
When to use this: you control (or subscribe to) an HTTPS endpoint that can accept JSON POSTs. If you need AMQP, Kafka, Pub/Sub, or cloud queues, use one of the dedicated providers.
All destinations share the same retry, circuit breaker, and DLQ behavior. See Delivery Pipeline for details.
Configuration
http destinations use the top-level url, method, headers, and timeout columns on the destination row — there's no nested config object required.
The destination URL. HTTPS in production.
HTTP method. POST, PUT, or PATCH.
Key-value map of custom headers merged into every request. Use this for auth tokens, content types, and provider-specific headers.
Request timeout in seconds. Requests exceeding this are aborted and retried per the destination's retry policy.
Outbound HMAC signing is configured separately on the destination's signing_config object, not inside the HTTP config. See Outbound Signing.
Authentication
HTTP destinations don't have a dedicated auth field — you set credentials via the headers map.
json{ "headers": { "Authorization": "Bearer sk_live_xxx" } }
Base64-encode user:pass and set the header manually:
json{ "headers": { "Authorization": "Basic dXNlcjpwYXNz" } }
json{ "headers": { "X-API-Key": "your_api_key" } }
Skip auth headers entirely and verify signatures on the receiver using Outbound Signing. hookstream signs every payload with HMAC-SHA256 when configured.
Delivery Headers
hookstream adds these headers to every HTTP delivery on top of your headers map:
X-hookstream-Event-Id— the originating event IDX-hookstream-Delivery-Attempt— the attempt number (1,2,3...)X-hookstream-Timestamp— ISO 8601 delivery timestamp
If a JSONata transform is configured on the connection, the transformed body is sent instead of the raw event.
Example
bashcurl -X POST https://hookstream.io/v1/destinations \ -H "X-API-Key: $HOOKSTREAM_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "My API", "type": "http", "url": "https://api.example.com/webhook", "method": "POST", "headers": { "Authorization": "Bearer sk_live_xxx", "X-Custom-Header": "value" }, "timeout": 30 }'
Enable outbound signing so your receiver can verify that requests actually came from hookstream — it's a one-line config change and gets you replay protection.
Destination Templates
hookstream ships with prefilled templates for common services. Pass template: "<name>" when creating a destination:
- Slack — incoming webhook URL,
Content-Type: application/json - Discord — webhook URL with the
/slacksuffix for Slack-compatible payloads - PagerDuty — Events API v2 with routing key
- Datadog — HTTP intake with
DD-API-KEYheader - Zapier — webhook trigger URL
- Linear — webhook URL with API key header