Allow or block Send a webhook

Supported editions for this feature: Business Starter, Business Standard, and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning add-on, and Education Plus. Supported add-ons for this feature: Google AI Pro for Education.

This feature is in limited preview.

Webhooks allow flows to send or receive data with an external link or API. The webhook step lets people connect to internal and external resources that aren't directly supported by Google Workspace Studio. However, people must be careful sharing your organization's data externally.

To protect your organization's data, Workspace Studio includes multiple security safeguards:

  • Turned off by default: Webhooks are turned off until an administrator explicitly turns them on for an organizational unit.
  • URL allowlist: On supported editions, webhooks only send data to domains and endpoints specified in your organization's URL allowlist.
  • User approval: By default, a person must review and confirm each webhook step before it's run.
  • Audit logging: Webhook execution requests and HTTP response status codes are recorded in the Admin audit logs.

Step 1: Turn webhooks on or off

  1. In the Google Admin console, go to Menu and then Apps and then Google Workspace and then Workspace Studio.

    Requires having the Service Settings administrator privilege.

  2. Click Webhooks settings.
  3. (Optional) To apply the setting to a department or team, at the side, select an organizational unit.
  4. Select ON to let users in the selected organizational unit use webhook steps in flows, or select OFF to block webhook steps.
  5. Click Save. Or, you might click Override for an organizational unit.

    To later restore the inherited value, click Inherit.

Step 2: (Optional) Restrict webhooks to an allowlist of URLs

Supported editions for this feature: Business Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus. Compare your edition.

You can restrict webhook steps to only send or receive data from specific allowlisted domains and URLs. This uses the shared URL allowlist for Google Drive, Docs, Sheets, and Apps Script.

Note: For editions that don't support URL allowlists, webhooks can connect to all valid URLs when the feature is turned on.

Manage the URL allowlist

  1. In the Google Admin console, go to Menu and then Apps and then Google Workspace and then Drive and Docs and then Features and Applications.

    Requires having the Service Settings administrator privilege.

  2. Click Importing and fetching from URLs.
  3. Select Allow importing and fetching only from the following URLs.
  4. Enter the authorized URLs or domains (for example, https://api.example.com).
  5. Click Save.

User approval for webhook steps

Because webhook steps communicate with external endpoints, they are treated as sensitive actions. When a flow uses a webhook step, Workspace Studio requires the user who is running or starting the flow to review and confirm the action before it runs.

You can manage user approval settings in the Admin console. For details, go to Require approval for flows that include external users.

Monitor webhook activity in Audit logs

You can review webhook usage and troubleshoot flow failures using the Workspace Studio log events in the Admin console.

  1. In the Google Admin console, go to Menu and then Reporting and then Audit and investigation and then Workspace Studio log events.

    Requires having the Audit and investigation tool administrator privilege.

  2. Filter by event name:

    • workflow_execution_success
    • workflow_execution_failure

  3. Inspect the event parameters:

    • Webhook request URL: The target URL invoked by the webhook step.
    • Webhook response Code: The HTTP status code returned by the target endpoint. For example, 200, 404, 500.