Skip to main content
A webhook is an HTTP request used to provide push notifications. Cobalt sends webhooks to programmatically inform you about changes to EHR accounts associated with your integrations or the status of asynchronous processes. For example, Cobalt will send a webhook when an appointment is cancelled in an EHR or when Cobalt is finished processing an asynchronous chart note upload.

​
Account-wide Scope

A webhook is registered per account (link client), not per connection. A single registration receives events for every connection and user under that account. The HMAC signing key is likewise a single account-wide key: rotating it affects the signature of every future delivery across all of your connections. POST /v1/webhook accepts only a webhook_url field. There is no per-connection webhook scoping. To tell which connection an event came from, read the access_token_id field on the event envelope.

​
Best Practices

  • Always use HTTPS for your webhook URL.
  • Keep your webhook secret key secure and rotate it regularly. Remember that rotation applies account-wide.
  • Respond to the webhook request quickly to acknowledge receipt.