Developers

Outbound webhooks

Receive signed events at your URL when messages, contacts, campaigns, deals or payments change.

Add an endpoint in Settings → Developer → Outbound webhooks and choose events (none selected means all). We POST JSON to your URL; your endpoint should reply 2xx within 8 seconds.

Envelope

{
  "version": "1.0",
  "timestamp": "2026-09-20T09:30:00+00:00",
  "type": "message_received",
  "data": { "message_id": "…", "from": "919876543210", "type": "text", "text": "Hi" }
}

Events

Group	Events
Messages	message_received, message_sent, message_delivered, message_read, message_failed
Contacts	contact_created, contact_opted_out, conversation_created, lead_captured
Templates & campaigns	template_status_update, broadcast_completed, flow_completed
Sales	deal_created, deal_stage_changed, deal_won, deal_lost, payment_received

Verify the signature

Each request has X-LFG-Event and X-LFG-Signature: sha256=<hex>, the HMAC-SHA256 of the raw request body with your endpoint secret. Reject requests whose signature doesn't match.

import crypto from "node:crypto";

export function verify(rawBody, header, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(header || ""));
}

import hmac, hashlib

def verify(raw_body: bytes, header: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header or "")

Endpoints that fail five deliveries in a row are disabled automatically. Fix the problem and re-enable the endpoint in Settings.

PreviousREST API reference (v1)Next Integrations

Something missing or unclear? Tell us and we'll improve this page.