Send a webhook every time a form is submitted

What a webhook does for a form

A webhook is a message your form sends to a URL you own. When a submission comes in, Forms 365 posts the submission to that URL as JSON. Your endpoint receives it and does whatever the moment calls for: create a ticket, kick off an onboarding task, notify a channel, or write into a system that does not live in Microsoft 365. No scheduled job checking for new rows, no lag.

What the request looks like

The delivery is an ordinary POST with a JSON body and a signature header, sent to the endpoint URL you register. A trimmed example:

POST https://your-app.example.com/hooks/forms
Content-Type: application/json
X-Signature: sha256=... (HMAC of the raw body, using your shared secret)

{
  "event": "submission.created",
  "formId": "supplier-onboarding",
  "submittedAt": "2026-07-22T03:14:00Z",
  "fields": {
    "companyName": "Acme Pty Ltd",
    "abn": "51824753556",
    "contactEmail": "ops@acme.example.com"
  }
}

Every delivery is signed. Forms 365 computes an HMAC-SHA256 of the raw body using a secret only you and the form share, and sends it in a header. Your endpoint recomputes the same hash and compares. If they do not match, drop the request. That check is what stops someone posting fake submissions to your URL.

Setting one up

1. 1

   Expose an endpoint

   Stand up a URL that accepts a POST and returns 2xx quickly. Use HTTPS so the payload is encrypted in transit.

2. 2

   Add the webhook to your form

   Point it at your endpoint URL and set the shared secret used to sign the payload.

3. 3

   Verify the signature

   On each request, recompute the HMAC of the raw body with your secret and compare it to the header before you trust the data.

4. 4

   Acknowledge fast, work async

   Return 2xx as soon as you have stored the payload, then do the slow work in the background so the delivery does not time out.

Deliveries are logged, so when an endpoint was down or returned an error you can see what happened rather than guess.

No native connector, and that is fine

Forms 365 does not ship a one-click Zapier or Make connector, and you do not need one. Both platforms accept an inbound webhook as a trigger. Point the form at the webhook URL those tools generate, verify nothing on their side if they do not support signatures, and you have a working automation in a few minutes. The webhook is the join between the form and whatever runs next.