> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook FAQs

> Answers common webhook questions about the 15-second timeout, the lack of retries, the payload format, and whether custom fields and attributes are sent.

## What's the timeout threshold on webhooks?

Lumos waits **15 seconds** for a webhook to respond before treating it as a timeout.

Webhooks do not retry, so a timed-out request is considered **failed/unsuccessful** in Lumos, even if the workflow or process succeeds in the service provider for each retry.

When a provisioning webhook times out, Lumos still tries to assign the employee the access was requested for to any IdP apps or IdP/email groups associated with the request. See [Provisioning Webhooks](/integrations/webhooks-itsm-and-manual-tasks/provisioning-webhooks).

After trying to add the user to the IdP/email groups, Lumos **always** creates a manual provisioning task for the App Admins to act on. Lumos assumes that some part of the provisioning workflow failed and needs manual action. See [Confirming Provisioning For Access Requests](/for-employees/for-your-workforce/confirming-provisioning-for-access-requests).

## Can I modify the content of the webhook payload?

This is not supported today. The fields and format of a webhook payload are static and cannot be modified when you create the webhook.

## Are custom intake fields sent in webhooks?

Yes. Lumos sends custom intake fields that you add to an application as part of the webhook payload. This includes request validation, pre-approval, provisioning, and deprovisioning webhooks.

If the app does not have custom intake fields configured, the field is sent as:

```text theme={null}
"custom_fields": None
```

## Are custom attributes sent in webhooks?

Custom attributes that you map to a user are **not** sent as part of the webhook payload today.

## What is the format of the webhook payload?

The Permission source is always one of the following values:

* MICROSOFT\_OAUTH
* MICROSOFT\_GCC
* GSUITE\_OAUTH = "GSUITE\_OAUTH"
* OKTA
* MANUAL
* ONELOGIN
* ATLASSIAN
* GOOGLE\_CLOUD
* LUMOS\_INTEGRATION
* JUMPCLOUD

```text theme={null}
{
  "application": {
    "type": "object",
    "properties": {
       "app_id": {
          "type": "string"
       },
      "instance_id": {
         "type": "string"
       },
       "user_friendly_label": {
         "type": "string"
       }
     }
  },
  "permissions": {
    "type": "array",
    "properties": {
      "label": {
        "type": "string"
      },
      "value": {
        "type": "string"
      },
      "type": {
        "type": "string"
      },
      "source": {
        "type": "string"
      }
    }
  },
  "target_user": {
    "type": "array",
    "properties": {
      "email": {
        "type": "string"
      },
      "given_name": {
        "type": "string"
      },
      "family_name": {
        "type": "string"
      }
    }
  },
  "access_length": {
     "type": "string, integer",
     "description": "The length of access in seconds"
   },
  "request_comment": {
     "type": "string"
   },
  "request_task_url": {
    "type": "string"
   },
  "custom_fields": {
     "type": "Optional[dict]"
   }
}
```

## More questions? See the [deep dive troubleshooting guide](/integrations/webhooks-itsm-and-manual-tasks/troubleshooting-failed-deprovisioning-tasks-with-custom-webhooks).