Updated Oct 2026

Review webhooks: get notified of new reviews by API

Most review platforms don’t tell you when a new review arrives. You poll, you handle each platform’s quota, and you still miss the one-star review that came in at 2 a.m. Prisma sends one signed webhook, in one format, for every new review and reply on 32 platforms, including the ones that have no webhooks of their own.

Get API key

2 locations free. Webhooks included on every plan.

Why review webhooks are hard to get from the platforms

• Google Business Profile pushes new reviews only through its Notifications API on Cloud Pub/Sub: one more Google product to set up, secure and monitor, after the API access approval.
• App Store Connect and Google Play have no review webhooks. You poll, and Play only returns the last 7 days.
• Yelp, Tripadvisor, Booking.com, OpenTable and most marketplaces offer no reply API and no push to third parties.
• Shopify review apps (Judge.me, Okendo, Loox, Yotpo…) differ one by one: some have webhooks on higher plans only, some none at all.

So “webhooks for reviews” usually means building a polling scheduler per platform, with its own rate limits, retries and cost. That is the part Prisma runs for you.

The events Prisma sends

Events carry IDs, not the whole review, so a late or retried delivery never overwrites newer data: fetch the current object with GET /v1/reviews/{id}.

curl -X POST https://api.prismareviews.com/v1/webhooks \
  -H "Authorization: Bearer $PRISMA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://yourapp.com/webhooks/prisma", "events": ["review.created", "reply.failed"]}'

// Express handler: verify the signature, then fetch the review
import crypto from "node:crypto";

app.post("/webhooks/prisma", express.raw({ type: "application/json" }), async (req, res) => {
  const [t, v1] = req.get("Prisma-Signature").split(",").map((p) => p.split("=")[1]);
  const expected = crypto.createHmac("sha256", process.env.PRISMA_WEBHOOK_SECRET).update(`${t}.${req.body}`).digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1))) return res.sendStatus(401);
  const event = JSON.parse(req.body);
  if (event.type === "review.created") {
    const r = await fetch(`https://api.prismareviews.com/v1/reviews/${event.data.id}`, { headers: { Authorization: `Bearer ${process.env.PRISMA_API_KEY}` } });
    const review = await r.json();
    if (review.rating <= 2) await notifySupport(review);
  }
  res.sendStatus(200);
});

# Flask handler
import hmac, hashlib, os
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/prisma")
def prisma_webhook():
    t, v1 = [p.split("=")[1] for p in request.headers["Prisma-Signature"].split(",")]
    expected = hmac.new(os.environ["PRISMA_WEBHOOK_SECRET"].encode(), f"{t}.".encode() + request.data, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, v1):
        abort(401)
    event = request.get_json()
    if event["type"] == "review.created":
        queue_review(event["data"]["id"])
    return "", 200

Delivery, retries and signatures

• Every delivery is a POST with Content-Type: application/json, User-Agent: Prisma-Webhooks/1 and a Prisma-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256> header. The secret is shown once when you create the endpoint.
• Any 2xx counts as delivered. Anything else is retried with backoff: for 24 hours on Spark, 72 hours on Beam and 7 days on Spectrum and Aurora. Retries reuse the same event id, so de-duplicate by id.
• Events can arrive out of order; use created_at to order them.
• Endpoints must be https://. List and delete them with GET and DELETE /v1/webhooks.

The full reference, with payloads and the signature check in three languages, is in the webhooks docs.

What people build on review webhooks

• Alerts: a Slack or email message for every review under 3 stars, with a link to answer it.
• Support tickets: open a ticket in your help desk for negative reviews, close it when reply.published arrives.
• Automation: an n8n or Zapier flow that routes reviews by location to the right manager.
• Dashboards: keep your own database in sync without polling, one row per review across every platform.

FAQ

Which review platforms have webhooks?

Very few offer webhooks for reviews to third parties. Google Business Profile needs the Notifications API plus Cloud Pub/Sub, and most others have no push at all, so you poll. Prisma polls or subscribes on its side and sends you one webhook format for all 32 platforms.

How fast does a review webhook arrive?

As soon as Prisma sees the review. For official APIs that is minutes after it appears, depending on the check frequency of your plan; for platforms read through their public page, checks run every few hours, depending on your plan.

How do I verify a review webhook?

Every delivery carries a Prisma-Signature header with a timestamp and an HMAC-SHA256 of the body, computed with the endpoint’s secret. Recompute it, compare in constant time and reject old timestamps.