Airtable webhook notification ping payload example

Airtable · event: notification ping · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Airtable's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
x-airtable-content-mac: hmac-sha256=940df7ad3c6d6f2223dae742c495805a02fd3cc6b6153ed81f492384335996c3

Body

{
  "base": {
    "id": "app3KtKzLJhSkQizy"
  },
  "webhook": {
    "id": "achw8VQuvvHLKJez7"
  },
  "timestamp": "2026-08-30T09:41:27.123Z"
}

Things that bite people

The ping contains no data — that's the whole model. Airtable webhooks are pull-based: the POST to your notificationUrl only says "something changed in base app… for webhook ach…". You then call the list webhook payloads API (a separate, authenticated request) to fetch the actual changes. Handlers that try to parse record data out of the ping body find three fields and nothing else.
This example's MAC actually verifies. X-Airtable-Content-MAC = hmac-sha256= + hex HMAC-SHA256 of the raw ping body, keyed with the base64-decoded macSecretBase64 from the create-webhook response (here Jc4Kc0PqbtnU0ILH+eGCSC8UZ9mQ7G0N4Ck1cnDoR+g=). Two classic bugs: keying the HMAC with the base64 string without decoding it first, and dropping the hmac-sha256= prefix. Try it in the signature debugger (Airtable provider), or set scheme "Airtable ping" + that secret on a capture bin for live ✓/✗ badges. The secret is returned exactly once at creation — there is no API to retrieve it later.
Failure disables the webhook. Success = HTTP 200 or 204 within 25 seconds (connect + send + respond). Anything else → up to 13 retries with exponential backoff starting at 10 s (≈ one day of retrying). If all 13 fail, Airtable drops the ping and disables notifications for the webhook — you must call the enable/disable-notifications API to turn them back on, then list payloads to catch up.
At-least-once, and coalesced. Spurious pings (no new changes) are possible, and several rapid changes may produce a single ping. Never count pings: each payload from the list-payloads API carries a sequential transaction number per webhook — that's your dedupe/ordering key, and the cursor you advance tells Airtable what you've consumed.
Webhooks expire after 7 days when created with a personal access token or OAuth. Calling refresh webhook — or just list webhook payloads — while the hook is active extends it. After expiry the metadata and payloads stay readable for another 7 days. Limits: 10 webhooks per base (a single OAuth integration can create at most 2), and API rate-limit overruns return 429 with a 30-second cool-off.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'x-airtable-content-mac: hmac-sha256=940df7ad3c6d6f2223dae742c495805a02fd3cc6b6153ed81f492384335996c3' \
 -d '{
  "base": {
    "id": "app3KtKzLJhSkQizy"
  },
  "webhook": {
    "id": "achw8VQuvvHLKJez7"
  },
  "timestamp": "2026-08-30T09:41:27.123Z"
}'

← All payload examples · Signature debugger · Docs