Segment track webhook payload example (webhooks destination)

Segment · event: track · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

See it live, not frozen

One click creates a free capture bin with this exact payload already in it — pretty-printed, headers inspectable, replayable to your own endpoint:

Then paste the bin's URL into Segment's webhook settings to capture a real delivery. No signup.

Headers

content-type: application/json
user-agent: Segment.io/1.0
x-signature: 6d729ef2f3463d8f7aeb41830650465a20026995

Body

{
  "version": 1,
  "type": "track",
  "userId": "019mr8mf4r",
  "event": "Purchased an Item",
  "properties": {
    "revenue": "39.95",
    "shippingMethod": "2-day"
  },
  "context": {
    "library": {
      "name": "analytics.js",
      "version": "4.1.0"
    }
  },
  "timestamp": "2026-08-30T06:15:00.276Z",
  "messageId": "ajs-next-8f3c2b1a9d7e6f5a4b3c2d1e0f9a8b7c"
}

Things that bite people

This example's signature actually verifies: bare 40-char hex HMAC-SHA1 (not SHA-256, no prefix) in X-Signature, keyed with the destination's optional Shared Secret. Try it with secret hookden-segment-sample-secret in the signature debugger (Segment scheme), or set the generic scheme with header x-signature on a capture bin — it now falls back to SHA-1 automatically.
Batch trap: Segment's own docs verify batched deliveries by hashing JSON.stringify(req.body[0]) — the signature covers only the first event in the array, not the whole batch body. A verifier that hashes the full raw batch will "fail" on perfectly genuine deliveries.
The docs' verification snippet hashes JSON.stringify(req.body) — the re-serialized parsed body, not the raw bytes. That works because Segment sends compact JSON that round-trips; but middleware that reorders keys or a framework that pretty-prints will break it. When in doubt, capture the exact wire bytes in a bin and compare.
Retry rules (verified vs the webhooks-destination docs, 2026-08-30): 5-second response deadline; timeouts and 5xx retry for up to 4 hours. You can configure up to 5 webhook URLs — but if delivery to any one succeeds, the message counts as processed and the others are not retried. Self-signed TLS certificates are rejected outright (no request is even sent).
Identify/page/screen/alias/group calls arrive at the same URL with the same envelope — route on type, and expect userId and timestamp on every call.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
  -H 'user-agent: Segment.io/1.0' \
  -H 'x-signature: 6d729ef2f3463d8f7aeb41830650465a20026995' \
 -d '{
  "version": 1,
  "type": "track",
  "userId": "019mr8mf4r",
  "event": "Purchased an Item",
  "properties": {
    "revenue": "39.95",
    "shippingMethod": "2-day"
  },
  "context": {
    "library": {
      "name": "analytics.js",
      "version": "4.1.0"
    }
  },
  "timestamp": "2026-08-30T06:15:00.276Z",
  "messageId": "ajs-next-8f3c2b1a9d7e6f5a4b3c2d1e0f9a8b7c"
}'

← All payload examples · Related guide · Signature debugger · Docs