Webhooks

Webhooks tell another system, such as a reporting tool or your own integration, that something changed in NeatPractice. Each notice carries record ids only, never patient details. The receiving system then fetches what it needs through the NeatPractice API with its own API key. An app whose key holds the webhooks:write scope can also add and remove its own endpoints through the API; they show in this list like any other.

Webhooks are part of plans that include API access. Open Setup, then Webhooks under Integrations.

Add an endpoint#

1. Click New Endpoint.
2. Enter the URL that receives the notices. It must be a public https:// address; NeatPractice never sends to private or local addresses.
3. Optionally add a Description, then choose the Events to send.
4. Click Save Endpoint.
5. Copy the Signing Secret and store it in the receiving system. It is shown only once.

Choose Send Test Event from the endpoint's actions to post a test event and see the response straight away.

Events#

You can send created and changed events for patients, appointments, visits, documents, claims and payments. A change still waiting to be sent is not queued twice, so a burst of edits to one record sends one notice. Each notice is a POST with a JSON body like this:

{
  "id": "0199a1b2-0000-7000-8000-000000000001",
  "type": "appointment.updated",
  "createdOn": "2026-10-16T14:05:00Z",
  "organizationId": "0199a1b2-0000-7000-8000-000000000002",
  "data": { "objectType": "appointment", "objectId": "0199a1b2-0000-7000-8000-000000000003" }
}

The id is the same for every endpoint that receives the event, so the receiver can drop a duplicate.

An automation rule with a Call a webhook action also posts to the endpoint it names, whatever events the endpoint lists. Its type is automation.rule, and data holds the rule's id, the trigger, and the record's type and id.

Check the signature#

Every request carries a Clinic-Signature header such as t=1760623500,v1=5f2c.... To check it:

1. Join the t value, a period and the raw request body.
2. Compute an HMAC with SHA-256 over that text, using the signing secret as the key.
3. Compare the result, in lowercase hexadecimal, with v1. Reject the request if they differ or if t is more than five minutes old.

The Clinic-Event-Id, Clinic-Event-Type and Clinic-Delivery-Attempt headers repeat the event id, the type and the attempt number.

Retries and the delivery log#

An answer in the 200 range counts as delivered. Anything else, or no answer within 10 seconds, is retried after 1 and 5 minutes, then after 15 minutes, 1, 4, 12 and 24 hours, eight tries in all. After 20 failures in a row the endpoint is turned off and shows Turned off after failures; edit it and turn Send events back on when the receiver is fixed.

The Delivery Log below the endpoints lists every event of the last 30 days with its status, attempts, last result and next try. Choose Send Again to resend one now.

Change or remove an endpoint#

• Click the endpoint to change its URL, description or events, or to turn Send events off.
• Replace Secret issues a new signing secret; the old one stops working at once.
• Delete stops all events to the endpoint. Its deliveries stay in the log until they are 30 days old.