Webhooks

Under Settings › Developers › Webhooks, add an HTTPS endpoint and choose its events. A workspace can have up to 25 endpoints. Each one gets its own signing secret, shown when you create it.

Events are named by object and change:

• contact.created, contact.updated, contact.merged
• deal.created, deal.stage_changed, deal.won, deal.lost
• ticket.created, ticket.closed
• agent.draft_approved, agent.draft_rejected

Each delivery carries the event, the record's ID and the fields that changed.

Every delivery has an Hourglass-Signature header like t=1760000000,v1=5f3a.... To check it:

1. Join the timestamp t, a period and the raw request body.
2. Compute an HMAC with SHA-256, using the endpoint's signing secret as the key.
3. Compare the result with v1 using a constant-time comparison.
4. Reject deliveries whose timestamp is more than 5 minutes old, so a captured request can't be replayed.

A delivery succeeds when your endpoint answers with a 2xx status within 10 seconds. Otherwise Hourglass retries up to 10 times over 24 hours, waiting longer each time. After 3 days of failures, the endpoint is turned off and admins get an email; turn it back on from the same screen.