HTTP and webhooks
Inbound and outbound. The floor under everything else here.
What it does
A signed inbound webhook per workspace and an outbound HTTP action inside any flow. Doc 6 puts it first in the build order for one reason: it unblocks every other tool on day one, and it is the fallback that makes every form builder work before a single bespoke form connector exists.
If a tool can POST JSON, it can start a Cosend automation. If a flow needs to call your API mid-run, it can.
Connecting it
No account to connect. An inbound URL is issued per workspace and signed; the outbound action runs against a per-tenant domain allowlist.
What to know before you rely on it
- Outbound calls are allowlisted per tenant
- The HTTP action is gateway-mediated against a domain allowlist you set, and it carries no credentials of ours. An automation cannot be talked into calling an arbitrary host.
- Inbound deliveries are signed
- Every inbound hook is verified before it reaches a flow, on the same timestamped HMAC scheme our outbound webhooks use.