[ OUTBOUND WEBHOOKS ]

Real-time event delivery to your systems.

Subscribe to platform events and receive signed HTTP POSTs within 500ms. HMAC-SHA256 verification, automatic retries with exponential backoff, and a complete delivery log in your dashboard.

All Integrations REST API Reference

[ HOW IT WORKS ]

Three steps, sub-second latency.

Event fires in LeapCrew AI

A message is received, a contact is created, an order is placed, or a delivery status changes.

Signed POST within 500ms

The platform constructs a JSON payload, signs it with HMAC-SHA256, and dispatches the HTTP POST to your endpoint.

Retry with exponential backoff

If your server responds with anything other than 2xx, we retry up to 5 times with increasing delays before marking the delivery failed.

[ EVENT TYPES ]

Subscribe to any event.

Event Type	Trigger
`message.received`	Inbound WhatsApp message from a contact
`message.status`	Delivery status update — sent, delivered, or read
`order.placed`	Native WhatsApp catalog order submitted
`contact.created`	New contact created via webhook, flow, or import

Sample Payload

message.received

{
  "id":        "evt_01J9XM7PV4BQRSP8WDCN7HGF2",
  "type":      "message.received",
  "created":   "2026-06-11T09:22:11Z",
  "data": {
    "message_id": "wamid.HBgNOTE5OD...",
    "from":        "+919876543210",
    "contact_id":  "cust_wP9K3xzFG",
    "body":        "I want to know more about your plan",
    "type":        "text"
  }
}

[ SIGNATURE VERIFICATION ]

Verify every delivery.

Every POST carries a x-leapcrew-signature header. Verify it server-side using HMAC-SHA256 with your endpoint secret.

Node.js verification

const crypto = require('crypto');

// Retrieve the signature from the request header
const sig = req.headers['x-leapcrew-signature'];

// Compute the expected HMAC-SHA256 signature
const expected = 'sha256=' + crypto
  .createHmac('sha256', process.env.WEBHOOK_SECRET)
  .update(req.rawBody)   // raw, unparsed body bytes
  .digest('hex');

// Reject requests with invalid signatures
if (!crypto.timingSafeEqual(
  Buffer.from(sig),
  Buffer.from(expected)
)) {
  return res.status(401).json({ error: 'Invalid signature' });
}

// Safe to process the event
const event = JSON.parse(req.rawBody);

Always compare signatures using timing-safe equality (crypto.timingSafeEqual) to prevent timing-based attacks.

[ RETRY POLICY ]

Five attempts, exponential backoff.

If your endpoint returns a non-2xx response or times out (10s limit), we automatically retry with increasing delays.

Attempt	Delay	Note
1st	Immediate	Delivered at event time
2nd	+1 minute	First retry window
3rd	+4 minutes	Exponential backoff
4th	+16 minutes	Extended retry
5th	+64 minutes	Final attempt
—	Marked failed	Webhook disabled after 5 consecutive failures

[ GET STARTED ]

Configure your first webhook in minutes.

Navigate to Settings → Webhooks in your workspace to add an endpoint and subscribe to events.

Open Settings