Skip to main content
Webhooks let Placet push review responses to your server via HTTP callbacks. Your agent sends a message with a review and a webhookUrl, and Placet POSTs the response to that URL when a human responds. This is the recommended connection type for background automations, CI/CD pipelines, and serverless functions that can’t maintain persistent connections.

When to Use Webhooks

  • Your agent runs as a background service or serverless function
  • You don’t want to hold a connection open waiting for a response
  • Your agent has a publicly accessible HTTP endpoint
  • You need fire-and-forget with async response handling
If your agent can’t expose a public endpoint, use Long-Polling or MCP instead.

Setting a Webhook URL

Webhook URLs can be set at three levels, in order of priority:

1. Per-message (highest priority)

Set webhookUrl directly on the message:

2. Per-channel (default for all messages)

Configure a default webhook URL on the channel/agent in the dashboard under Settings > Channels. This URL is used for all messages in that channel unless overridden by a per-message URL.

3. Legacy callback (lowest priority)

Set review.callback on the review object:
The first matching webhook URL wins. If a message has webhookUrl, the channel-level and callback URLs are ignored.

Webhook Payload

When a human responds, Placet POSTs a JSON payload to your webhook URL:
The response shape depends on the review type:

Webhook Server Example

A minimal Express.js server that handles webhook callbacks:

Delivery Status

Placet tracks webhook delivery and exposes the status in the dashboard:

Retrying Failed Deliveries

When a webhook delivery fails, users can retry from the dashboard UI. The retry re-sends the original payload.

Security

SSRF Protection

Placet validates all webhook URLs and blocks requests to private/internal IP ranges to prevent SSRF attacks:
  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16
  • 127.0.0.0/8
  • ::1, fd00::/8
Your webhook endpoint must be publicly accessible. Placet will reject requests to private IP addresses and localhost URLs.

Timeouts

Webhook requests have a 10-second timeout. If your endpoint doesn’t respond within 10 seconds, the delivery is marked as webhook_failed.

Recommendations

  • Return 200 OK as quickly as possible — process the payload asynchronously
  • Implement idempotency using the message.id field to handle retries
  • Validate the payload structure before processing
  • Use HTTPS for your webhook endpoint in production