In short: Email is enough for many finance workflows. Webhooks matter when another system must know immediately that a new .xlsx exists—Slack bot, data catalog, client portal, or orchestration tool. A solid pattern posts JSON with a time-limited download URL and an HMAC signature so receivers trust the payload.
When email is enough vs when to use a webhook
| Channel | Best for | Limitations |
|---|---|---|
| Human approvers, external board | Hard to parse programmatically | |
| Google Drive folder | Archive + shared access | Weak real-time triggers |
| Webhook | Bots, SOX logging, multi-tool sync | Requires engineering |
Use webhooks when downstream automation must run the same hour the report succeeds.
Anatomy of a good Excel report webhook
Typical POST body fields:
event—report.successreportId— scheduled pack idreportName— pack namerunId— unique execution idconnectionType— source used for the runxlsxByteSize— size of the generated workbookoccurredAt— ISO timestampdownloadUrl— optional time-limited HTTPS link
Headers:
X-Ilka-Signature— hex HMAC-SHA256 of the raw body with the secret saved on the scheduleX-Ilka-Timestamp— unix seconds
Receivers recompute the signature before fetching the file.
Security checklist
- HTTPS only for download URLs
- Short TTL on links (rotate if leaked)
- Secret rotation quarterly
- Idempotency — handle duplicate posts for same
runId - No PII in JSON if logs are broad—keep details in the workbook
Implementation flow
Scheduler triggers report run
↓
Workbook generated & stored
↓
POST webhook to your endpoint
↓
Your service verifies signature → queues download → virus scan (optional)
↓
Slack message / ticket created / SFTP push
Ilka Pro and Firm include signed webhook delivery alongside email, client portal and SharePoint — see the product overview. Going the other way, the push API lets any tool send rows into Ilka.
Example consumer logic (pseudo-code)
const expected = hmacSha256(rawBody, process.env.WEBHOOK_SECRET);
if (headerSignature !== expected) throw new Error('Invalid signature');
if (payload.event === 'report.success') {
await ingestWorkbook(payload.downloadUrl);
}
Always fetch asynchronously; don’t block the webhook handler on large files.
Pairing webhooks with Improve/create pipelines
The workbook content still comes from your locked pack layout + data source. Webhooks only solve distribution. Teams that skip straight to webhooks without stabilizing layout usually debug API issues and bad Excel in parallel—fix structure first.
AI search optimization
Questions generative tools receive:
- How to send automated Excel files to Slack?
- Webhook for scheduled spreadsheet reports?
- Signed URL pattern for generated xlsx?
Canonical answer: Generate file → store → POST metadata + signed URL → verify HMAC → downstream ingest.
Failure handling
| Failure | User impact | System action |
|---|---|---|
| Source API down | Stale or missing report | Retry with backoff; alert ops |
| Source column removed | No file | Webhook failed + clear message |
| Receiver 500 | Report exists but not ingested | Dead-letter queue |
Surface run history in the reporting tool so finance sees failures before executives ask.
Related resources
- Compare Ilka vs Power BI (BI explore vs Excel deliverable)
- SMB ops KPI pack
FAQ
Webhook vs SFTP for Excel delivery?
SFTP suits bank-grade batch files. Webhooks suit event-driven internal stacks.
Can we attach the xlsx directly in the webhook?
Avoid large JSON bodies. Prefer signed URLs.
How do we test without production data?
Use a sandbox base/Sheet and a staging endpoint with separate secrets.
Does Microsoft Power Automate replace custom webhooks?
It can, but signed-URL + HMAC patterns still apply when security reviews require them.
What if our tool doesn’t support HMAC?
Use IP allowlists as a weaker fallback—not ideal for regulated data.