Webhooks: receive events in your own system

1. Open Settings → Webhooks and click Add endpoint.
2. Give it a name, paste the https:// address your system listens on, and tick the events you want (leave them all unticked to receive every event). The address must be public — LeadFlow refuses private or internal addresses.
3. Click Create. The signing secret is shown exactly once — copy it into your system now. If you lose it, use Rotate secret to get a new one; the old one stops working the moment you rotate.
4. Click Send test event to prove the connection. The result shows under Last test.

Every payload carries the lead (or conversation) as it is after the change, who caused it, and an id that is the same across retries — use it to ignore a duplicate. Payloads never contain WhatsApp message text, AI drafts, transcripts or media.

Each delivery carries an X-LeadFlow-Signature header of the form t=1731050000,v1=…. Compute HMAC-SHA256 with your signing secret over the string t + "." + raw request body and compare it with v1 using a constant-time comparison. Reject a request whose t is more than five minutes old. The header X-LeadFlow-Event names the event and X-LeadFlow-Delivery the delivery, for your logs.

Answer with any 2xx within 10 seconds. Anything else — a 4xx or 5xx, a redirect (LeadFlow never follows them), a timeout — is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours, then LeadFlow gives up on that event. The delivery log on each endpoint shows every attempt as a sentence ("Delivered (200)", "Failed — got 503, retrying in 30 min", "Gave up after 6 tries", "Resend failed — got 503") with a Redeliver button. A redelivery is a single try.

When 20 events in a row are given up, the endpoint pauses and every admin gets one email. Events that happen while it is paused are kept in the log as Skipped. Fix your endpoint, Send test event (tests work while paused), then click Resume — it tells you how many events were skipped and offers Resume and resend or Resume only. Disable is different: events while disabled are not delivered later, and the confirm says so.

Create a Webhooks by Zapier → Catch Hook (or a Make Custom webhook) and paste the URL it gives you as the endpoint address. Send a test event from LeadFlow so the tool learns the fields, then map them to your sheet, CRM or email step.