> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hookstream.io/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP / Webhook

Deliver events to any HTTP endpoint with custom headers, auth, timeouts, and optional outbound HMAC signing.

The `http` provider posts events to any HTTP endpoint. This is the most common destination type — use it for your own APIs, Slack, Discord, PagerDuty, Zapier, Linear, Datadog, or anything that accepts an HTTP webhook.

**When to use this**: you control (or subscribe to) an HTTPS endpoint that can accept JSON POSTs. If you need AMQP, Kafka, Pub/Sub, or cloud queues, use one of the dedicated providers.

All destinations share the same retry, circuit breaker, and DLQ behavior. See [Delivery Pipeline](/concepts/delivery-pipeline) for details.

## Configuration

`http` destinations use the top-level `url`, `method`, `headers`, and `timeout` columns on the destination row — there's no nested `config` object required.

The destination URL. HTTPS in production.

HTTP method. `POST`, `PUT`, or `PATCH`.

Key-value map of custom headers merged into every request. Use this for auth tokens, content types, and provider-specific headers.

Request timeout in seconds. Requests exceeding this are aborted and retried per the destination's retry policy.

Outbound HMAC signing is configured separately on the destination's `signing_config` object, not inside the HTTP config. See [Outbound Signing](/guides/outbound-signing).

## Authentication

HTTP destinations don't have a dedicated auth field — you set credentials via the `headers` map.

**Bearer token**

```json
    {
      "headers": {
        "Authorization": "Bearer sk_live_xxx"
      }
    }
    ```
  **Basic auth**

Base64-encode `user:pass` and set the header manually:

    ```json
    {
      "headers": {
        "Authorization": "Basic dXNlcjpwYXNz"
      }
    }
    ```
  **API key**

```json
    {
      "headers": {
        "X-API-Key": "your_api_key"
      }
    }
    ```
  **None (HMAC)**

Skip auth headers entirely and verify signatures on the receiver using [Outbound Signing](/guides/outbound-signing). hookstream signs every payload with HMAC-SHA256 when configured.

## Delivery Headers

hookstream adds these headers to every HTTP delivery on top of your `headers` map:

- `X-hookstream-Event-Id` — the originating event ID
- `X-hookstream-Delivery-Attempt` — the attempt number (`1`, `2`, `3`...)
- `X-hookstream-Timestamp` — ISO 8601 delivery timestamp

If a JSONata transform is configured on the connection, the transformed body is sent instead of the raw event.

## Example

```bash
curl -X POST https://hookstream.io/v1/destinations \
  -H "X-API-Key: $HOOKSTREAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My API",
    "type": "http",
    "url": "https://api.example.com/webhook",
    "method": "POST",
    "headers": {
      "Authorization": "Bearer sk_live_xxx",
      "X-Custom-Header": "value"
    },
    "timeout": 30
  }'
```

Enable [outbound signing](/guides/outbound-signing) so your receiver can verify that requests actually came from hookstream — it's a one-line config change and gets you replay protection.

## Destination Templates

hookstream ships with prefilled templates for common services. Pass `template: "<name>"` when creating a destination:

- **Slack** — incoming webhook URL, `Content-Type: application/json`
- **Discord** — webhook URL with the `/slack` suffix for Slack-compatible payloads
- **PagerDuty** — Events API v2 with routing key
- **Datadog** — HTTP intake with `DD-API-KEY` header
- **Zapier** — webhook trigger URL
- **Linear** — webhook URL with API key header

## Next Steps

**[Destinations](/concepts/destinations)**

How destinations, retries, and circuit breakers fit together.
  **[Outbound Signing](/guides/outbound-signing)**

Sign outbound requests so your receiver can verify them.
  **[Destinations API](/api/destinations)**

Full API reference for creating and managing destinations.
  **[AWS SQS](/providers/aws-sqs)**

Push to queues instead of HTTP endpoints.