# Get a signed webhook when a job is completed

> An automation with a status_transition trigger and a send_webhook step calls your URL the moment a job moves to completed, whoever moved it: a technician in the app, an office user, the REST API or an AI agent.

Source: https://www.fieldproxy.ai/developers/guides/job-completed-webhook

## 1. The rule

Store your endpoint's shared secret in the workspace's encrypted secret vault and refer to it as `{{secrets.NAME}}`; it is never written into the rule.

automation rule:

```json
{
  "name": "Tell our ERP when a job is completed",
  "enabled": true,
  "trigger_type": "status_transition",
  "trigger_config": { "table": "jobs", "field": "status", "to": "completed" },
  "action_spec": {
    "steps": [
      { "type": "send_webhook",
        "url": "https://erp.example.com/hooks/fieldproxy",
        "secret": "{{secrets.ERP_WEBHOOK_KEY}}",
        "body": { "event": "job.completed", "job_id": "{{trigger.row.id}}" } }
    ]
  }
}
```

## 2. Verify the signature

Every delivery carries `X-Fieldproxy-Signature: t=<unix>,v1=<hex>`, an HMAC-SHA256 of `<t>.<raw body>` with your secret, plus `X-Fieldproxy-Timestamp` and `X-Fieldproxy-Delivery`. Check it against the raw body before you trust the payload, and reject old timestamps.

Node.js:

```javascript
// Node.js: verify a Fieldproxy send_webhook delivery
import crypto from "node:crypto"

function verify(rawBody, header, secret, toleranceSec = 300) {
  // header: "t=<unix>,v1=<hex>"
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")))
  const expected = crypto.createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`).digest("hex")
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < toleranceSec
  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))
}
```

## Other events

Swap the trigger for any other: a record created or updated (`entity_event`, with conditions such as priority is urgent), a schedule (`cron`), an SLA timer and more. To call an API that is not yours, use the `http_request` step with any method, headers and body.

http_request step:

```json
{ "type": "http_request",
  "url": "https://api.example.com/v1/work-orders",
  "method": "POST",
  "headers": { "authorization": "Bearer {{secrets.PARTNER_API_KEY}}" },
  "body": { "job_id": "{{trigger.row.id}}" },
  "timeout": 15000, "retries": 2 }
```

## Questions

### Can Fieldproxy send a webhook when a job is completed?

Yes. An automation with a status_transition trigger and a send_webhook step calls your URL when a job moves to completed, whoever completed it.

### How do I verify a Fieldproxy webhook?

Each delivery has an X-Fieldproxy-Signature header, t=<unix>,v1=<hex>, an HMAC-SHA256 of the timestamp and raw body with your shared secret. Recompute it and compare.

### Can Fieldproxy call any third-party API?

Yes. The http_request automation step calls any URL with any method, headers and body, with secrets kept in an encrypted vault.

## This is one way, not the only way

This guide shows one common way to do it. A Fieldproxy workspace can be reached from every side, and anything in it can be read, changed or automated:

- REST API: read, insert, update and delete on any table the key allows ([REST API reference](https://www.fieldproxy.ai/developers/docs/rest-api)).
- MCP server: 170+ tools for Claude, ChatGPT, Copilot, Cursor and your own agents, including read-only SQL, proposed writes, automations and app building ([MCP tools](https://www.fieldproxy.ai/developers/docs/mcp-tools)).
- Automations: 15 trigger types and about 50 step types, with webhooks in and signed webhooks and HTTP calls out ([Webhooks and automations](https://www.fieldproxy.ai/developers/docs/webhooks-automations)).
- Public forms, record links and customer portals for people outside the company ([Public forms and links](https://www.fieldproxy.ai/developers/docs/public-forms)).
- Apps as JSON: new screens, fields, tables and workflows ([Apps as JSON](https://www.fieldproxy.ai/developers/docs/apps-as-json)).
- Voice and text agents that work from the same data ([Voice and text agents](https://www.fieldproxy.ai/developers/docs/agents)).
- Not listed here? Fieldproxy's team builds integrations with the other systems you use as part of setting up your workspace. [Tell us what you need](https://www.fieldproxy.ai/book-demo?source=dev-guides).

More: [REST API reference](https://www.fieldproxy.ai/developers/docs/rest-api) · [OpenAPI](https://www.fieldproxy.ai/developers/openapi.json) · [All guides](https://www.fieldproxy.ai/developers/guides)