Signed with HMAC-SHA256
Each delivery carries a signature computed from the body and your endpoint secret, so your receiver can verify the request really came from us before acting on it.
OUTBOUND WEBHOOKS
Your systems find out the moment it happens
Twenty-six events, from a contact being created to a support promise being breached, delivered to your endpoint as signed HTTP POSTs with automatic retries. No polling loop, no cron job asking whether anything changed.
- 26 events
- HMAC-SHA256 signed
- Retries with backoff
app.crmsolid.com/settings/developers
Endpoint healthyEndpoint
https://api.yours.dev/hooks/crm
Subscribed
deal.won, invoice.paid, support.ticket.breached
X-Signature: sha256=…
Recent deliveries
deal.won
200 · 142ms
invoice.paid
200 · 96ms
support.ticket.breached
503 · retrying
Every event you can subscribe to
Subscribe an endpoint to the events it cares about rather than receiving everything and filtering on your side.
Contacts and pipeline
- contact.created
- contact.updated
- contact.deleted
- pipeline.stage_changed
Messaging
- message.sent
- message.received
- sequence.completed
Outreach sequences
- outreach.step.sent
- outreach.replied
- outreach.completed
- outreach.unsubscribed
Deals
- deal.created
- deal.updated
- deal.stage_changed
- deal.won
- deal.lost
Tasks
- task.created
- task.completed
Finance
- invoice.created
- invoice.paid
- finance.transaction.created
- subscription.changed
Support desk
- support.ticket.created
- support.ticket.updated
- support.ticket.resolved
- support.ticket.breached
The boring reliability details that decide whether you trust it
Anybody can POST a JSON body. Signing it, retrying it and letting you see what happened is the part that makes it usable in production.
Retries with backoff
A failed delivery is retried on a backoff rather than dropped, so a deploy window or a brief outage on your side does not silently lose the event that mattered.
A delivery log you can read
See what was sent, when, what your endpoint answered and how long it took. Debugging an integration stops being an argument about whether the event fired.
Subscribe per event
Each endpoint subscribes to the events it wants. A fulfilment service that only cares about invoice.paid does not have to receive and discard every contact update.
Several endpoints
Up to twenty endpoints, so a warehouse system, an internal Slack relay and a data warehouse can each get their own feed with their own secret.
Test before you rely on it
A test event lets you verify the endpoint, the signature check and your handler before a real deal.won depends on all three working.
Support SLA breaches included
support.ticket.breached fires when a reply-time promise is missed, which is the one event most teams want in an on-call channel rather than in a dashboard nobody has open.
The whole business, not just contacts
Contacts, pipeline stages, messages, outreach steps and replies, deals, tasks, invoices, transactions, subscriptions and support tickets all emit events.
Paired with the REST API
The webhook tells you something happened; the public REST API lets you read or change the record it happened to. Together they replace polling entirely.
What outbound webhooks are for
A webhook is CRM Solid making an HTTP POST to a URL you control the moment something happens, rather than your code asking us every few minutes whether anything has. Twenty-six events are available, each delivery is signed, failures are retried, and the log shows exactly what your endpoint answered.
The practical difference is latency and cost. A polling job that runs every five minutes is both five minutes late and mostly wasted requests. A webhook arrives in under a second and only when there is something to say.
Verifying a delivery really came from us
Each endpoint has its own secret. We compute an HMAC-SHA256 of the request body with that secret and send it as a signature header; your receiver recomputes it and compares. A request without a matching signature should be rejected.
Compare in constant time rather than with a normal string equality, and treat the secret like a password: it is the only thing standing between your endpoint and anybody who guesses the URL.
What happens when your endpoint is down
A non-2xx response or a timeout marks the delivery failed, and it is retried on a backoff. That covers the ordinary cases: a deploy, a restart, a momentary database lock.
Because retries exist, your handler has to be idempotent. Design it so that receiving the same event twice produces the same result as receiving it once, usually by keying on the event id. This is true of every webhook system, and it is the mistake that most often shows up as duplicate records.
What it costs
Outbound webhooks are a Business feature at $99 a month, with up to twenty endpoints. The public REST API, which pairs with them, is available from Pro. If you would rather not write a receiver at all, the Zapier and n8n integrations consume the same events.
Frequently asked questions
Twenty-six, covering contacts and pipeline stages, messaging, outreach sequences, deals, tasks, invoices and transactions, subscriptions, and support desk tickets including SLA breaches.
Each delivery is signed with HMAC-SHA256 using your endpoint secret. Recompute the signature from the raw body and compare it in constant time; reject anything that does not match.
Failed deliveries are retried with a backoff rather than dropped, and the delivery log shows each attempt with the response your endpoint gave. Because of retries, your handler should be idempotent.
Yes, up to twenty, each with its own secret and its own event subscription, so different systems get different feeds.
No. Outbound webhooks are a Business feature at $99 a month. The public REST API is available from Pro.
Use the Zapier or n8n integrations. They consume the same events and let you route them into other apps without writing or hosting anything.
The rest of the developer surface
Ready to ship
Stop polling for changes
Webhooks are included on Business. The REST API starts on Pro.
Free forever plan · GDPR-ready · No credit card required