zitadel/apps/docs/content/guides/integrate/actions/webhook-site-setup.mdx

---
title: Testing Actions V2 with Webhook.site
description: "Forward ZITADEL Actions V2 events to Webhook.site and verify them locally using XHR Redirect and CORS headers setup"
sidebar_label: Testing Actions V2 with Webhook.site
---

## 1. Introduction

This guide explains how to test **ZITADEL Actions V2** locally using [Webhook.site](https://webhook.site).
We will use Webhook.site’s **XHR Redirect** feature to forward requests from ZITADEL to your local machine.

**What you will learn in this guide:**

- How to add the required CORS headers to your local listener
- How to configure Webhook.site with XHR Redirect
- How to create a target in ZITADEL and link it to your Action
- How to verify forwarded requests in your terminal

---

## 2. Prerequisites

### 2.1. Local Listener

You should already have a local HTTP server (for example, the Go example listener from [Testing a Request](./testing-request)) running at `http://localhost:8090/webhook`.

### 2.2. CORS Headers

Because Webhook.site’s XHR redirect runs in your browser, your listener must allow CORS.
Add the following headers in your handler:

```go
w.Header().Set("Access-Control-Allow-Origin", "*")
w.Header().Set("Access-Control-Allow-Methods", "*")
w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")

if req.Method == http.MethodOptions {
    w.WriteHeader(http.StatusOK)
    return
}
```

---

## 3. Configure Webhook.site XHR Redirect

1. Open your unique Webhook.site URL.
2. Click **Configure XHR Redirect**.
3. Enable **XHR Redirect**.
4. Enter your local endpoint in **Target**, e.g.:

   ```
   http://localhost:8090/webhook
   ```

5. Leave other fields empty unless you need custom headers.
6. Keep the Webhook.site browser tab open while testing.

<img src="/docs/img/actions-v2/webhook-xhr.png" alt="Screenshot: Webhook.site XHR Redirect configuration interface"/>

---

## 4. Run Your Listener

Start your local listener:

```sh
go run actionsRequest.go
```

You should see output in your console whenever the listener is called.

<img src="/docs/img/actions-v2/console.png" alt="Screenshot: Console output showing listener receiving webhook requests"/>

---

## 5. Create Target in ZITADEL

As shown in the example above, the target is created with HTTP and port '8090'. If you want to use it as a webhook, the target can be created as follows:

See [Create a target](/reference/api/action/zitadel.action.v2.ActionService.CreateTarget) for more detailed information. Notice that the `endpoint` is your Webhook.site URL.

```shell
curl -L -X POST 'https://${CUSTOM_DOMAIN}/v2/actions/targets' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "name": "local webhook",
  "restWebhook": {
    "interruptOnError": true
  },
  "endpoint": "https://webhook.site/29fa2769-e2f6-44ff-8eb0-2434b83507d8/webhook",
  "timeout": "10s"
}'
```

<img src="/docs/img/actions-v2/webhook-url.png" alt="Screenshot: Webhook.site target creation interface"/>

---

Save the returned ID to use in the execution step. A sample response looks like this:

```json
{
    "id": "337246363446151234",
    "creationDate": "2025-09-10T13:21:36.959699Z",
    "signingKey": "OpUHaCtEqh8swdJ5xUYbQ2bhej1abcXYZ"
}
```

## 6. Set execution

To configure ZITADEL to call the target when an API endpoint is called, set an execution and define the request condition.

See [Set an execution](/reference/api/action/zitadel.action.v2.ActionService.SetExecution) for more detailed information.

Here, `<TargetID returned>` is the `id` from the previous step.

```shell
curl -L -X PUT 'https://${CUSTOM_DOMAIN}/v2/actions/executions' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
    "condition": {
        "request": {
            "method": "/zitadel.user.v2.UserService/AddHumanUser"
        }
    },
    "targets": [
        "<TargetID returned>"
    ]
}'
```

---

## 7. Example Call

Now that you have set up the target and execution, you can test it by creating a user through the Management Console UI or by calling the ZITADEL API to create a user.

Here, we are creating a user via the API:

```shell
curl -L -X PUT 'https://${CUSTOM_DOMAIN}/v2/users/human' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
    "profile": {
        "givenName": "Example_given",
        "familyName": "Example_family"
    },
    "email": {
        "email": "[email protected]"
    }
}'
```

Both your Webhook.site and your local listener should now print out something like the following. See the [Sent information Request](./usage#sent-information-request) payload description for details.

Your local listener should look like this:
<img src="/docs/img/actions-v2/local-listener.png" alt="Screenshot: Local listener output"/>

Your Webhook.site should look like this:
<img src="/docs/img/actions-v2/webhook-listener.png" alt="Screenshot: Webhook.site request log"/>

---

## 8. Done

You now have a fully working setup for testing ZITADEL Actions V2 with Webhook.site. This allows you to forward requests securely from ZITADEL to your local environment without needing a public IP address or domain.