Webhooks

A form’s Webhook URL receives one HTTPS POST for each response, shortly after the response arrives. Use it to tell another system that a response came in: an automation tool, your own API, or a chat channel by way of something that formats the message.

Set it in the builder: click the gear icon, then Notifications and integrations. See Form settings.

Set it up

1. Add the URL to the form. It must start with https://. Anything else is rejected when you save.
2. Allow its host in Salesforce. In Setup, go to Security, then Remote Site Settings, and click New. Enter the scheme and host only, for example https://hooks.zapier.com, and leave Active ticked. Sliick Forms cannot do this for you, because the URL is chosen per form.
3. Send a test response from the builder’s Test link and check that it arrives.

Skip step 2 and nothing arrives, and nothing tells you. Salesforce refuses the call, the response is still saved, and no error appears in the builder, in Form Log or by email. If a new webhook never arrives, check Remote Site Settings first.

What it sends

A POST with Content-Type: application/json and this body:

{
  "formExternalId": "support-intake",
  "submissionId": "a0B5g00000XyZabEAB",
  "correlationId": "web-12345",
  "receivedAt": "2026-10-03T01:02:03.000Z",
  "payload": {
    "email": "casey@example.com",
    "issueSummary": "Cannot access account"
  }
}

Field	What it is
formExternalId	The form’s public ID
submissionId	The 18-character ID of the Form Submission record in Salesforce
correlationId	The link ID the response arrived with, or null
receivedAt	When Salesforce received the response, in UTC
payload	The answers, keyed by each field’s API name

The answers are exactly as the respondent sent them. A repeating group is an array of row objects. See The submission payload for the full shape. A correction saved later in the responses console does not change what the webhook sends.

Read the fields by name. Their order in the body is not fixed.

Slack, Teams and other chat apps

A chat app’s own incoming webhook URL does not work here. Slack, Microsoft Teams and Discord each expect a message in their own format. Slack, for example, needs a text field and turns this body away with 400 no_text. Sliick Forms does not report an endpoint that turns a delivery away, so the message simply never appears.

Put something in between that turns the response into a message:

• A Salesforce flow. Build a record-triggered flow on Form Submission that runs when a record is created, and post the message with Salesforce’s Slack actions or your own. This needs no webhook and no Remote Site Setting. A flow sees the record, not the body above, and the answers sit in one field as JSON (Raw Payload JSON). The simplest message is “New response to form name” with a link to the record. Add entry conditions so the flow skips records with Is Test, Suspected Duplicate or Failed Validation ticked.
• An automation service such as Zapier (Webhooks by Zapier, Catch Hook) or Make (Custom webhook). Use the URL it gives you as the Webhook URL, add its host to Remote Site Settings, then add a Slack or Teams step that posts the answers you choose.
• Your own endpoint, such as a small serverless function that reshapes the body and forwards it to the chat app’s incoming webhook.

When it is sent, and when it is not

• Once per response, in the background. It arrives shortly after the response is saved, not instantly. It does not wait for the response to be processed onto records.
• No retries. Each delivery has 10 seconds. If your endpoint is down or answers with an error, that delivery is lost. The response itself is safe in Salesforce, and you can find it in the responses console.
• Occasionally twice. A delivery that was in flight when its background job failed is sent again. Use submissionId to ignore a repeat.
• Test responses are sent too, and the body does not say so. To tell them apart, look up the record by submissionId and check its Is Test field.
• Held responses wait. A suspected duplicate is sent when someone clicks Mark as genuine, and a response that failed validation when someone clicks Accept for processing. receivedAt still shows when it first arrived, so it can be days old. Clearing either flag by editing the record directly sends nothing.
• Nothing is sent for a response that was never saved, such as an exact repeat of one already received, or one that arrived after the form closed.
• Changing the URL affects later responses only. A delivery already queued goes to the URL the form had when the response arrived.
• Large bursts use your org’s daily asynchronous Apex allowance, ten deliveries per background job. A delivery that cannot be queued is not sent, and is recorded in Form Log under the operation WebhookChain.

Keep the URL private

Treat the Webhook URL like a password. Anyone who has it can post to it. An automation service’s URL already contains a long random token. For your own endpoint, put a long random value in the path.