Webhooks

Verify the signature, then handle lead events at least once.

PUT /api/webhooks registers the URL that receives lead events. The body is { "url": "https://example.com/hooks" }. The URL must be https.

The first PUT is 201 and returns the URL and the signing secret. Later PUTs replace the URL, keep the same secret, and return only the URL. A lost first response is not shown again. Integrations shows the URL and does not show the secret.

Events are not sent for the submit itself. They are sent when a queued lead is accepted (lead.delivered), when status changes (lead.status_changed), and when a queued lead is declined (lead.declined). The account that sent the lead receives the event, and so does each parent account that has a webhook, for leads in that parent’s Leads Sent scope.

The POST body is JSON. A retry posts the same id. lead.declined has no status.

Headers:

• X-CM-Timestamp is the unix time used in the signature.
• X-CM-Signature is hex HMAC-SHA256 of ${timestamp}.${rawBody} using the signing secret.
• X-CM-Event-Id is the event id.

Delivery is at least once. A failed POST keeps the same id and is retried after two minutes, up to 8 attempts, without waiting for another lead. Verify the signature over the raw body before trusting the JSON.