Types of webhook integrations
| Type | Where to configure | Use case |
|---|---|---|
| Outbound webhooks (Workflow actions) | Automation > Workflow actions | Trigger an HTTP call when a specific workflow step runs |
| Inbound webhooks (Premium triggers) | Automation > Premium triggers | Receive data from external systems to trigger a workflow |
| API-based webhooks | Settings > Private integrations | Subscribe to account events via the API v2 webhook subscription |
Outbound webhooks via automation
The most common way to send data from the platform to an external system is through the Webhook action in a workflow.Create or open a workflow
Go to Automation > Workflows and open an existing workflow or create a new one.
Configure the endpoint
- Method — select
POST(recommended),GET,PUT, orDELETE - URL — enter the destination webhook URL from your external system (e.g., Zapier Webhook URL, Make.com URL, or your own server)
- Headers — add authentication headers if required (e.g.,
Authorization: Bearer your-token) - Body — choose JSON or Form format and map the fields you want to send
Use custom values and merge fields
Use merge tags (e.g.,
{{contact.email}}, {{contact.full_name}}, {{opportunity.name}}) to dynamically populate the webhook body with contact or opportunity data.Test the webhook
Use a tool like Webhook.site or RequestBin to capture and inspect test payloads before sending to your production endpoint.
Webhook actions require a published workflow. Test mode workflows do not send real webhook requests to external servers.
Inbound webhooks (premium trigger)
Use the Inbound Webhook premium trigger to receive data from an external system and use it to trigger a workflow inside the platform. Steps:- In a workflow, set the trigger to Inbound Webhook.
- The platform generates a unique webhook URL for this workflow.
- Configure your external system to POST data to this URL.
- Map the incoming JSON fields to contact or custom fields in the workflow.
API v2 webhook subscriptions
Using the platform API v2, you can programmatically subscribe to account-level events and receive webhook notifications for any supported event type. Supported event categories include:- Contact created / updated / deleted
- Opportunity stage changed
- Form submitted
- Appointment booked / cancelled
- Payment received
- Conversation message received
- Create a Private Integration with the appropriate scopes (see Private integrations).
- Use the API v2
/webhooksendpoint to create a webhook subscription. - Provide your endpoint URL and select the event types to subscribe to.
- Verify the subscription using the confirmation token sent to your endpoint.
Webhook payload structure
Webhook payloads are sent as JSON. A typical event payload includes:Security and authentication
To verify that webhook requests originate from the platform:- Shared secret / HMAC signature — configure a secret key and validate the
X-Hmac-Signatureheader on incoming requests - Authorization headers — use static bearer tokens in outbound webhook headers
- IP allowlisting — restrict your endpoint to accept requests only from known platform IP ranges
Troubleshooting webhooks
Webhook not firing
Webhook not firing
- Verify the workflow is published and the webhook action is active
- Check that the trigger conditions are met for the contact or record
- Review the workflow execution history for error messages
Endpoint returns error responses
Endpoint returns error responses
- Ensure your server returns a 2xx response within 30 seconds
- Check server logs for authentication failures or payload parsing errors
- Test the endpoint manually using curl or Postman with a sample payload
Payload fields are missing or empty
Payload fields are missing or empty
- Confirm the contact record has the fields you are trying to send
- Check merge tag syntax — use
{{contact.email}}not{{email}} - Enable test mode and inspect the payload before going live
Duplicate webhook deliveries
Duplicate webhook deliveries
- The platform may retry failed webhook deliveries. Implement idempotency on your endpoint using a unique event ID to avoid processing duplicates.
.png?fit=max&auto=format&n=EQK5eX9kTD8NzWwA&q=85&s=878008bf159fcc4964d0c0d508b6e400)