Webhooks

Create a webhook endpoint

Your endpoint must accept HTTPS POST with JSON body. Respond with HTTP 200 to acknowledge delivery.

POST /your-endpoint
Content-Type: application/json

{
  "id": "lead_123",
  "category": "solar",
  "contact": { "name": "Jane Doe", "email": "jane@example.com", "phone": "+1 555 0100" },
  "metadata": { "source": "meta" },
  "createdAt": "2025-01-01T12:00:00Z"
}

Verify authenticity

Use shared tokens or signatures to verify requests. The header may include a token such as x-webhook-token or a signature header depending on your configuration.

• Reject requests without valid token/signature
• Use constant-time comparison to avoid timing attacks
• Replay-protect with a timestamp and nonce, if provided

Retries and idempotency

If your endpoint fails, deliveries may be retried. Ensure your handler is idempotent by using the lead `id` to deduplicate.

Testing

Use staging credentials or a tool like ngrok to receive events locally and validate your parsing and verification logic.