Webhooks: subscribing to events
Subscribe a URL to lead events: who can subscribe, the subscription calls and the endpoint rules.
Webhooks send lead activity to a URL you host, typically within 15 minutes of the activity. They're
near-real-time, not instant. Every event is the same event the API returns from
/leads/{leadId}/activity?events=1, with the same id, so you can look an event up or rebuild what
you missed.
Who can subscribe
- Owner and admin keys only. Every subscription covers the whole brokerage.
- Up to 10 subscriptions per brokerage.
- Blocking a key pauses the subscriptions it created.
Managing subscriptions. These calls change only your subscription settings, never your Ruuster data.
| Call | What it does |
|---|---|
GET /webhooks/events |
The event catalog with a sample payload for each kind |
GET /webhooks |
Every subscription in your brokerage, with delivery health. Describes the subscription object |
POST /webhooks |
Create. Returns 201 and the signing secret, once |
GET /webhooks/{webhookId} |
One subscription |
PATCH /webhooks/{webhookId} |
Change url, events, description, or status (active | paused) |
DELETE /webhooks/{webhookId} |
Delete; pending deliveries are dropped |
POST /webhooks/{webhookId}/test |
Send a webhook.test now and return the result |
POST /webhooks/{webhookId}/rotate-secret |
New secret; the old one keeps working for 24 hours |
GET /webhooks/{webhookId}/deliveries |
Attempts from the last 30 days |
POST /webhooks/{webhookId}/replay |
Re-send events from a window of up to 7 days, within the last 30 |
The secret is never returned again after creation or rotation. Subscriptions are active, paused (by you), disabled (after about 24 hours of failed deliveries) or blocked (by Ruuster).
Endpoint rules. HTTPS with a valid public certificate. URLs that point at private, loopback or
link-local addresses are refused when you save them and again before every delivery. No credentials in
the URL.