Lead channel webhooks

Each lead channel has its own webhook URL. Posting JSON to that URL creates a new lead under the channel. Use webhooks when the source system can't embed our public form — for example Zapier, Make, n8n, or a custom backend.

• Content-Type must be application/json.
• The path {secret} is the channel's webhook secret.
• The optional ?channel={slug} query routes the lead to a sibling channel; see Routing across channels.
• Rate limit: 30 requests per minute per IP. Excess requests get an HTTP 429.

The webhook secret embedded in the URL is the credential. No additional auth header is required.

• Treat the secret like a password. Anyone with the URL can post leads.
• Rotate it from the channel's Webhook tab via Regenerate secret. Existing integrations break the moment you regenerate.

The body is a flat JSON object. The intake pipeline extracts four target fields — customerName, customerEmail, customerPhone, message— and stores every other key on the lead's fields map.

Default keys (no custom mapping)

When the channel has no custom mapping, the first non-empty string found at any of these keys is used:

Custom mapping

If the channel has a custom mapping configured (Fields tab), source keys are read directly from your mapping and the default key fallbacks are skipped. Unmapped keys still land in the lead's fields map.

Every channel has its own webhook secret and its own URL slug. By default, posting to a channel's URL creates a lead in that same channel. The ?channel=<slug> query lets you use one channel's secret to file leads into a different channel in the same tenant.

Use this when the upstream system only has room for one webhook URL but you want to split incoming leads across multiple channels based on something it sends.

• The slugfor each channel is shown on its Webhook tab right below the URL. It's the same slug used by the channel's public form at /forms/<slug>.
• The target channel (the one named in ?channel=) must have webhook intake enabled. The channel that owns the secret does not have to — the secret is purely an auth token in this case.
• Without ?channel=, the secret's own channel is the target and it must have webhook intake enabled.

The endpoint always returns HTTP 200 with the body { "received": true }. Errors and skipped requests also return 200; the outcome is recorded as a WebhookEvent row that you can inspect in the channel's Webhook tab under Recent payloads.

Every request produces exactly one WebhookEvent row with one of these statuses:

curl

curl -X POST '<YOUR_API_URL>/leads/webhook/<your-secret>' \
  -H 'Content-Type: application/json' \
  -d '{
    "customerName": "Ada Lovelace",
    "customerEmail": "[email protected]",
    "customerPhone": "+1-202-555-0100",
    "message": "Need a quote for a kitchen remodel"
  }'

Node.js (fetch)

await fetch(
  '<YOUR_API_URL>/leads/webhook/<your-secret>',
  {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      customerName: 'Ada Lovelace',
      customerEmail: '[email protected]',
      customerPhone: '+1-202-555-0100',
      message: 'Need a quote for a kitchen remodel',
    }),
  },
);

Zapier / Make

1. Add a "Webhooks by Zapier" action and choose "POST".
2. URL: paste the webhook URL from the channel's Webhook tab.
3. Payload Type: JSON.
4. Data: map your trigger's fields to customerName, customerEmail,
   customerPhone, and message. Extra fields are preserved on the lead.
5. Wrap Request In Array: No. Unflatten: Yes.