Connect your systems

Use this journey to deliver the result of a workflow to one of your systems through a webhook, prove to that system that the call came from Cogneris, and follow every delivery. It also covers Connections, where you register REST endpoints and their credentials.

Who may do it:

Procedure	Profile
Configure the webhook of a Send phase	Administrator or technical (publishing the workflow)
See, copy and regenerate the webhook signing secret	Administrator only
Follow and resend deliveries (Integrations & Deliveries)	Administrator or technical — the service refuses everyone else
Create, edit, test and delete connections	Administrator only. Other profiles can only read Connections.

The signing secret is shared only with the people who run the receiving system — never in a ticket or an e-mail thread.

Send results to a webhook

1. In the workflow editor, add a Send phase where the result must leave the workflow, usually at the end.

2. In its configuration fill in:

   Field	What to enter
   Integration name	A name for your system, for example My CRM
   Endpoint URL (HTTPS)	The address that receives the call. Only HTTPS is accepted.
   HTTP method	POST, PUT, PATCH or DELETE
   Description (optional)	What this integration does

   With an endpoint URL set, the phase posts the previous phase's output to it instead of sending an e-mail. Without one, it e-mails the output to Recipient email with the Subject you set.

3. Optional: Test endpoint checks that the address answers — Endpoint reachable. or Endpoint not reachable: ….

4. Save and publish. Publishing is refused with Send phase webhook endpoint must be a valid HTTPS URL. when the address is not a valid HTTPS URL.

Try the payload before pointing to your system

Under Test URL, after saving the workflow, select Generate test URL. Cogneris gives you a temporary address that captures everything the phase sends.

• Use as endpoint puts it in Endpoint URL; run the workflow; View requests lists what arrived (time, method, status, size, headers and payload).
• The URL expires after the number of days shown; its history is kept for 7 days. Revoke ends it earlier.
• Replace it with your real endpoint before going live.

Verify that a call came from Cogneris

Administrators see the phase's Signing secret, with Copy and Regenerate. It is created when an endpoint is set, and at the latest when the workflow is published.

Each call carries:

Header	Content
X-Xtrakt-Signature	sha256= followed by the hexadecimal HMAC-SHA256 of the raw request body, keyed with the signing secret
X-Xtrakt-Run-Id	The process (run) that produced the call
X-Xtrakt-Workflow-Id	The workflow
Content-Type	application/json; charset=utf-8

Your system recomputes the HMAC over the body exactly as received and compares it with the header. Use the secret as the text shown — do not decode it from hexadecimal.

Regenerate invalidates the previous secret at once: update the receiving system at the same time, then publish.

Follow and resend deliveries

1. Go to Administration › Integrations & Deliveries. The page is titled Webhook Deliveries.
2. Filter by From, To, Workflow and Status (Success or Failed), then Apply.
3. Each line shows Date/Time, Workflow, Document, Endpoint, HTTP Status, Response time, Outcome and Attempt.
4. Select a line for Delivery detail: the same fields plus Run ID, Error message and Payload sent.
5. To deliver again, select Resend webhook. Webhook resent successfully. or Resend failed. confirms the result.

Cogneris retries a delivery automatically only when your system answers 5xx, 408 or 429. Any other 4xx answer is treated as final: fix the cause, then resend.

Register a REST connection

Connections holds reusable base URLs and credentials for REST integrations.

Who uses a connection

The REST integration phase of the workflow editor calls a connection; see Phases you can use. The base URL and the credentials live only in the connection, never in the phase. Usage lists the workflows whose phases use it.

1. Go to Administration › Connections and select New connection.

2. Fill in Name (up to 120 characters, unique), Base URL (must start with https://, without credentials in it, and point to a public address), Authentication type and Timeout (seconds, 1 to 120).

3. Fill in the credentials of the authentication type:

   Authentication	Fields
   None	—
   API key	API key location (Header or Query string), Parameter name, the key
   Basic (user and password)	Username, password
   Bearer token	The token
   OAuth2 (client credentials)	Token URL, Client ID, client secret, Scope (optional), Audience (optional), Client authentication

4. Optional: Default headers are sent with every call. Mark a header Secret to store its value encrypted.

5. Select Save.

Secrets are write-only: once saved they show only as ••••• set. Replace sets a new value; leaving it untouched keeps the stored one. Secrets are stored encrypted; if they cannot be encrypted, the save is refused rather than storing them in clear.

Test connection (on a saved connection, while editing) sends one GET to the base URL with the connection's authentication and reports Connection OK: HTTP {status} in {ms} ms or Connection test failed: …. It never shows a secret or the response body. Tests are rate limited.

Delete removes the connection and wipes its secrets. A connection used by a published workflow cannot be deleted; the screen lists those workflows.

How to confirm it worked

• The test URL, or your system, received the call with a valid X-Xtrakt-Signature.
• Webhook Deliveries shows the delivery with Success and the HTTP status your system answered.

If something goes wrong

What you see	What it means	What to do
Enter a valid HTTPS URL.	The endpoint is not HTTPS	Use an HTTPS address.
Deliveries show Failed with a 4xx status	Your system refused the call; it is not retried	Fix the receiving side, then Resend webhook.
Your system rejects the signature	Wrong secret, or the body was changed before checking	Copy the current secret; compute the HMAC on the raw body; use the secret as text.
Signing secret is not shown	Your profile is not administrator	Ask your company administrator.
Webhook Deliveries does not load	Your profile is neither administrator nor technical	Ask your company administrator.
The URL resolves to a non-public address.	The connection points to a private network	Use a publicly reachable address.
A connection with this name already exists.	Names are unique	Choose another name.

Not observed yet

• Not walked in a signed-in session; captures are pending.
• The JSON layout of the payload is not documented here yet; use Test URL to see it.

---

Last reviewed 2026-10-09 · Version 1.0.0 · Owner: product-documentation