ERP Webhook & Outbound Callback Support Comparison (2026)

TL;DR

• Bottom line: Only 4 of 12 major ERPs offer true native outbound webhook/push capabilities without add-ons: Dynamics 365 Business Central (subscription webhooks), Zoho (workflow webhooks), Acumatica (push notifications), and Salesforce (Outbound Messages). The rest require event bus infrastructure, custom scripting, or middleware.
• Key limit: Workday and Epicor Kinetic have NO native outbound push mechanism — you must poll or use iPaaS middleware to simulate webhooks.
• Watch out for: ERP vendors use “webhook” loosely — Salesforce Platform Events, SAP Event Mesh, and Oracle Business Events are event bus architectures requiring subscribers to connect via gRPC, AMQP, or dedicated clients, not simple HTTP POST callbacks.
• Best for: Architects evaluating which ERPs can push data in real-time vs. which require polling or middleware to achieve the same result.
• Authentication: Varies per system — OAuth 2.0 (Salesforce, D365), certificate-based (SAP BTP), token-based (NetSuite TBA), or API keys (Zoho, Acumatica).

System Profile

This comparison covers 12 major ERP systems across the spectrum of outbound event delivery capabilities, from native HTTP webhook support to event bus architectures to polling-only systems. The focus is on outbound notifications — what happens when a record changes inside the ERP and an external system needs to know about it.

This card does NOT cover inbound webhooks (external systems pushing data into the ERP). For deep-dive event architecture comparisons with protocol-level detail, see the ERP Event-Driven Integration Comparison card.

API Surfaces & Capabilities

Each ERP takes a different approach to outbound notifications. This table maps the primary outbound event mechanisms available on each platform. [src1, src2, src3, src4]

Rate Limits & Quotas

Outbound Event Delivery Limits

Authentication

Authentication Gotchas

• Salesforce Outbound Messages send a session ID that the receiving endpoint can use to call back into Salesforce — but this session expires, so do not rely on it for delayed processing [src1]
• D365 Business Central subscriptions require a handshake: the subscriber must echo back the validationToken in the body with HTTP 200 within a few seconds, or the subscription is rejected [src4]
• SAP Event Mesh webhook subscriptions support optional HMAC signatures, but many implementations skip this — always enable HMAC in production [src2]

Constraints

• Workday has NO native outbound push mechanism — the only options are scheduled PECI extracts or polling the REST/SOAP API from the external side [src5]
• Epicor Kinetic has no built-in webhook or event push — outbound calls require custom BPM code (Epicor Functions) that make REST calls during transaction processing
• Salesforce Outbound Messages are SOAP-only — if your endpoint only accepts REST/JSON, you need middleware or Platform Events + a custom subscriber
• D365 Business Central webhook notifications are batched with a 30-second delay by default [src4]
• NetSuite outbound HTTP calls from SuiteScript consume governance units — effectively limiting ~500 outbound calls per scheduled script [src3]
• SAP Event Mesh requires a separate BTP subscription — not included in S/4HANA Cloud license [src2]
• Zoho webhook limits are plan-dependent: free 500/day, paid up to 5,000/day [src8]
• Oracle ERP Cloud Business Events cannot directly POST to external URLs — they must route through Oracle Integration Cloud (OIC)

Integration Pattern Decision Tree

START -- Need real-time outbound notifications from ERP
|-- Which ERP?
|   |-- Salesforce
|   |   |-- Simple field-change notifications -> Outbound Messages (SOAP callback)
|   |   |-- Structured events with replay -> Platform Events + Pub/Sub API (gRPC)
|   |   +-- Full change tracking -> Change Data Capture + Pub/Sub API
|   |-- SAP S/4HANA Cloud
|   |   |-- Have BTP subscription? -> SAP Event Mesh (AMQP or Webhook)
|   |   +-- No BTP? -> Poll OData API or use IDocs (legacy)
|   |-- Oracle ERP Cloud
|   |   |-- Have OIC? -> Business Events -> OIC -> external webhook
|   |   +-- No OIC? -> Poll REST API (no native push available)
|   |-- NetSuite
|   |   |-- Simple triggers -> User Event Script afterSubmit -> https.post()
|   |   |-- Workflow-driven -> Workflow Action Script -> https.post()
|   |   +-- High volume -> Scheduled Script with SuiteQL batch + push
|   |-- D365 Finance & Operations
|   |   |-- Standard processes -> Business Events -> Azure endpoint
|   |   |-- Data-level changes -> Data Events -> Azure Service Bus
|   |   +-- Simple CRUD -> Dataverse webhooks (if using Dataverse)
|   |-- D365 Business Central
|   |   +-- Any entity change -> Webhook Subscription API (REST, 30s batched)
|   |-- Workday
|   |   |-- Payroll changes -> PECI (scheduled, not real-time)
|   |   +-- All other data -> Poll REST/SOAP API from external system
|   |-- IFS Cloud
|   |   +-- Record changes -> Event Action -> REST POST to external URL
|   |-- Epicor Kinetic
|   |   +-- Transaction events -> Custom BPM/Function -> REST POST
|   |-- Sage Intacct
|   |   +-- Limited events -> Custom Sender or poll Web Services API
|   |-- Zoho
|   |   +-- Workflow triggers -> Webhook action (HTTP POST, JSON)
|   +-- Acumatica
|       +-- Data changes -> Generic Inquiry + Push Notification (HTTP POST)
|-- Need guaranteed delivery?
|   |-- YES -> Salesforce Platform Events (replay) or SAP Event Mesh (DLQ)
|   +-- NO -> Any native push mechanism + custom retry
+-- Latency requirement?
    |-- <5 seconds -> Salesforce, Zoho, D365 F&O, IFS Cloud, Acumatica
    |-- <30 seconds -> D365 BC, SAP Event Mesh, Oracle (via OIC)
    +-- Minutes acceptable -> Polling (any ERP), Workday PECI

Quick Reference

Webhook/Push Support at a Glance

Cross-System Comparison

Step-by-Step Integration Guide

1. Evaluate your ERP's outbound capabilities

Classify your ERP into one of three tiers. [src1, src4, src6, src8]

Tier 1 — Native HTTP Webhooks (D365 BC, Zoho, Acumatica, Salesforce Outbound Messages): ERP pushes HTTP POST natively.

Tier 2 — Event Bus or Custom Script (Salesforce PE, SAP Event Mesh, Oracle via OIC, NetSuite SuiteScript, D365 F&O, IFS Cloud): Events emitted to bus or custom script pushes.

Tier 3 — Polling Required (Workday, Sage Intacct, Epicor without customization): No push mechanism.

Verify: Check the Quick Reference table to confirm your ERP's tier.

2. For Tier 1: Configure webhook subscription

Example: D365 Business Central. [src4]

# Register a webhook subscription for Sales Orders in D365 Business Central
curl -X POST "https://{tenant}.api.businesscentral.dynamics.com/v2.0/{env}/api/v2.0/subscriptions" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "notificationUrl": "https://your-endpoint.example.com/webhook/d365bc",
    "resource": "salesOrders",
    "clientState": "your-secret-state-value"
  }'

Verify: BC sends validation request → endpoint echoes validationToken → HTTP 200.

3. For Tier 2: Set up subscriber infrastructure

Example: Salesforce Platform Events via Pub/Sub API. [src1]

# Subscribe to Salesforce Platform Events via gRPC Pub/Sub API
import grpc
from salesforce_pubsub import PubSubClient

client = PubSubClient(
    instance_url="https://yourorg.my.salesforce.com",
    client_id="your_connected_app_id",
    client_secret="your_connected_app_secret",
    username="[email protected]"
)
for event in client.subscribe("/event/Order_Created__e", replay_preset="LATEST"):
    print(f"Order created: {event.payload}")

Verify: Publish test Platform Event → subscriber receives within 1–5s.

4. For Tier 3: Implement efficient polling

Example: Workday. [src5]

# Poll Workday REST API for worker changes
import requests

def poll_workday_changes(tenant, token, last_poll_time):
    url = f"https://wd5-impl-services1.workday.com/ccx/api/v1/{tenant}/workers"
    headers = {"Authorization": f"Bearer {token}"}
    params = {"limit": 100, "offset": 0}
    response = requests.get(url, headers=headers, params=params)
    response.raise_for_status()
    return response.json().get("data", [])
# Poll every 5 minutes -- store last_poll_time for recovery

Verify: Run poll → compare record counts with Workday UI.

Error Handling & Failure Points

Common Error Codes

Failure Points in Production

• D365 BC subscription silently deleted: Non-retryable HTTP status permanently deletes the subscription. Fix: Always return 200 on success, 500 for temporary failures. Monitor subscription existence with periodic GET /subscriptions. [src4]
• Salesforce Outbound Messages queue overflow: If endpoint is slow, the retry queue can overwhelm it on recovery. Fix: Acknowledge immediately, process asynchronously in background. [src1]
• NetSuite governance exhaustion mid-batch: Bulk imports trigger User Event Scripts for each record, exhausting governance. Fix: Queue to custom record, process in Scheduled Script (5,000 units). [src3]
• SAP Event Mesh delays under peak load: 30+ second delivery delays during high traffic. Fix: Switch to AMQP protocol for lower latency. [src2]
• Acumatica Push Notifications tied to GI refresh: Not truly real-time if GI refresh interval is long. Fix: Use Business Events with custom actions for true real-time needs. [src6]

Anti-Patterns

Wrong: Assuming all ERPs have Stripe-style webhooks

// BAD -- designing integration expecting simple HTTP POST from any ERP
app.post('/webhook/erp', (req, res) => {
  const event = req.body; // Salesforce sends SOAP XML, not JSON
  processERPEvent(event); // SAP sends via AMQP, not HTTP
  res.status(200).send('OK'); // Workday doesn't send anything at all
});

Correct: Design per-ERP adapter with fallback to polling

// GOOD -- ERP-specific adapter pattern
const adapters = {
  'd365bc':     new WebhookAdapter({ format: 'json', verify: 'clientState' }),
  'salesforce': new SOAPAdapter({ verify: 'sessionId', ipWhitelist: SF_RANGES }),
  'zoho':       new WebhookAdapter({ format: 'json', verify: 'header-token' }),
  'acumatica':  new WebhookAdapter({ format: 'json', verify: 'url-token' }),
  'workday':    new PollingAdapter({ interval: '5m', changeDetection: 'timestamp' }),
  'sap':        new AMQPAdapter({ queue: 'event-mesh', protocol: 'amqp10' }),
};

Wrong: SuiteScript User Events for high-volume outbound calls

// BAD -- calling external API in afterSubmit for every record
function afterSubmit(context) {
  var record = context.newRecord;
  https.post({ url: WEBHOOK_URL, body: JSON.stringify(record) });
  // Bulk import of 1,000 records = governance exhaustion
}

Correct: Batch and defer outbound calls in NetSuite

// GOOD -- queue records, send in batch via Scheduled Script
function afterSubmit(context) {
  var queue = record.create({ type: 'customrecord_outbound_queue' });
  queue.setValue({ fieldId: 'custrecord_record_id', value: context.newRecord.id });
  queue.save(); // Cheap: ~10 governance units
}
// Scheduled Script processes queue with 5,000 governance units

Wrong: Not handling D365 BC subscription expiry

// BAD -- register webhook once and forget
await registerWebhook(resource, notificationUrl);
// 3 days later: subscription silently expires

Correct: Implement subscription renewal

// GOOD -- renew D365 BC subscription before 3-day expiry
async function maintainSubscription(subscriptionId) {
  const renewed = await fetch(`/subscriptions(${subscriptionId})`, {
    method: 'PATCH',
    body: JSON.stringify({
      expirationDateTime: new Date(Date.now() + 3 * 86400000).toISOString()
    })
  });
  if (renewed.status === 404) await registerWebhook(resource, notificationUrl);
}
// Run on a 2-day interval

Common Pitfalls

• Assuming “webhooks” means HTTP POST everywhere: Each ERP’s mechanism differs in protocol, payload, and delivery semantics. Fix: Read the Cross-System Comparison table and implement per-ERP adapters. [src1, src2]
• Ignoring delivery guarantee differences: Salesforce PE offers at-least-once with replay; D365 BC offers at-most-once; Workday offers nothing. Fix: For zero-loss, use systems with replay capability and implement idempotent processing. [src1, src4]
• D365 BC batching delays: 30-second notification delay; >1,000 changes merge into one collection notification. Fix: Handle both single and collection notifications. [src4]
• NetSuite governance on outbound calls: User Event Script on bulk import exhausts limits after ~100 calls. Fix: Use Map/Reduce scripts (10,000 units) for bulk outbound. [src3]
• Forgetting Workday requires polling: No event-driven outbound mechanism exists. Fix: Design polling from the start. Use RaaS with timestamp filtering, poll every 5-15 min. [src5]
• SAP Event Mesh without BTP budget: Separate pricing from S/4HANA. Fix: Confirm BTP licensing before committing to event-driven SAP integration. [src2]

Diagnostic Commands

# Salesforce: Check Outbound Message delivery status
# Setup -> Outbound Messages -> View Message Delivery Status

# D365 Business Central: List active webhook subscriptions
curl -H "Authorization: Bearer $BC_TOKEN" \
  "https://{tenant}.api.businesscentral.dynamics.com/v2.0/{env}/api/v2.0/subscriptions"

# NetSuite: Check governance usage
# Customization -> Scripting -> Script Execution Log (filter by script type)

# SAP Event Mesh: Check webhook subscription status
curl -H "Authorization: Bearer $BTP_TOKEN" \
  "https://enterprise-messaging-pubsub.cfapps.{region}.hana.ondemand.com/messagingrest/v1/subscriptions"

# Acumatica: Verify Push Notification config
# System -> Integration -> Push Notifications (SM302000) -- check Status column

# Zoho: Check webhook execution log
# Setup -> Automation -> Workflow Rules -> select rule -> View Webhook Log

Version History & Compatibility

When to Use / When Not to Use

Important Caveats

• Webhook/event capabilities change with each ERP release — features listed as “not available” may gain support in future releases. Always verify against current release notes.
• “Native webhook” definitions vary by vendor — this card classifies only simple HTTP POST callbacks as native webhooks. Event bus architectures require dedicated subscriber infrastructure.
• Delivery guarantees are best-case scenarios — always implement idempotent event processing.
• Pricing and licensing for event features vary — SAP Event Mesh, Salesforce high-volume PE, and Oracle OIC all require separate licensing.
• This card covers outbound (ERP-to-external) direction only. Inbound webhook support is a separate concern.
• Latency figures are typical ranges — actual latency depends on payload size, network, endpoint speed, and system load.