# Webhook Authentication + Schema

**URL:** <https://community.servicem8.com/t/webhook-authentication-schema/1095>\
**Category:** API & SDK\
**Created:** [May 11, 2026, 10:21pm UTC](https://community.servicem8.com/t/webhook-authentication-schema/1095 "2026-05-11T22:21:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![matt\_fuaux](https://avatars.discourse-cdn.com/v4/letter/m/bcef8e/32.png) [@matt\_fuaux](https://community.servicem8.com/u/matt_fuaux)\
**Post date:** [May 11, 2026, 10:21pm UTC](https://community.servicem8.com/t/webhook-authentication-schema/1095/1 "2026-05-11T22:21:31Z")

</div>

Hi, just wondering if there is any plan for adding authentication for inbound webhooks? Also is there anywhere I can find a copy of the inbound webhook schema?

---

<div class="post-metadata">

**Author:** ![Cody](https://sea2.discourse-cdn.com/flex002/user_avatar/community.servicem8.com/cody/32/52_2.png) [@Cody](https://community.servicem8.com/u/Cody)\
**Post date:** [May 14, 2026, 10:23pm UTC](https://community.servicem8.com/t/webhook-authentication-schema/1095/2 "2026-05-14T22:23:20Z")

</div>

Hi Matt,

For the standard ServiceM8 Webhooks API (where ServiceM8 sends POSTs to your callback URL), subscriptions are managed via `https://api.servicem8.com/webhook_subscriptions`.

On the callback/auth side, the docs describe an initial verification step for public (OAuth 2) apps where ServiceM8 POSTs `mode=subscribe` and a `challenge` value, and your endpoint responds with only the `challenge` value.

For the inbound webhook payload schema, the docs show that after verification ServiceM8 sends an HTTP POST with a JSON body in this shape (high level): `object`, `entry[0].uuid`, `entry[0].changed_fields`, `entry[0].time`, and `resource_url`.

Also worth noting: webhook updates only indicate that fields changed (they don’t include the field values), so you’ll typically use the REST API and the provided `resource_url` to fetch the full record.

If you meant Add-on SDK web service callbacks (web-service hosted add-ons), the inbound request body is a JWT, and the JWT is signed (HMAC-SHA-256) using your Add-on’s App Secret, which lets you validate the request came from ServiceM8.

Docs here:

- Webhooks overview (verification + payload example): [Overview](https://developer.servicem8.com/docs/webhooks-overview)
- Web service hosted add-ons (JWT signing): [Web Service Hosted Add-ons](https://developer.servicem8.com/docs/web-service-hosted-add-ons)

Which webhook type are you using: Webhooks API subscriptions, or an Add-on SDK callback URL?

Thanks,  
Cody