The lead webhook

POST every lead to your CRM: the payload, the signature, and the retry rules.

Set a webhook URL on the Lead qualifier page and we POST the whole lead to it the moment it gets a verdict: the contact, their answers, the verdict and its reason, who decided it, the ad it came from, and the chat history.

The five events

Event	When it fires
lead.created	A new lead’s first message opens the conversation.
lead.qualified	The lead met one of your qualifying scenarios.
lead.disqualified	The lead was decided the other way.
lead.message	Every later message on the conversation, with the chat so far.
lead.message_status	One of your messages moved to delivered, read or failed.

Which leads you receive

“All leads, with their qualification status” sends all five events for every lead, whatever their verdict — including leads still being asked questions.

“Qualified leads only” is the narrower choice, and it narrows all of it: you get lead.qualified, and you get lead.message and lead.message_status only for leads that have actually qualified. A lead who is still undecided, or who was disqualified, sends you nothing at all — no first message, no ongoing chat, no delivery receipts.

That is the usual reason a CRM sees a lead’s later messages but never the lead: pick “All leads” if your system wants the conversation from its first line.

The request

Method POST, Content-Type: application/json.
Body: { "event": …, "id": <delivery id>, "created_at": <ISO-8601>, "data": { … } }.
X-WABridge-Event names the event; X-WABridge-Delivery is the delivery id.
X-WABridge-Signature is sha256=<hex HMAC-SHA256 of the exact request body, keyed with your signing secret>.

The signing secret is shown once, when you create the endpoint. Copy it then — it cannot be shown again. Verify the signature against the raw body bytes, before parsing.

Retries

We try four times, backing off roughly 10 seconds, then a minute, then five minutes, with a 10-second timeout per attempt. Any 2xx counts as delivered. A 5xx or a 429 is retried; any other 4xx is treated as a permanent refusal and not retried, because a 400 means the next identical attempt fails too.

Seeing what happened

“Recent deliveries” at the bottom of the Lead qualifier page shows each attempt with its status, the HTTP code and the error text on failure. The Integrations page has the same log plus a “Redeliver” button; a redelivery reuses the original delivery id, so a receiver that de-duplicates on it will not double-process.

URLs must be https, and addresses on private or reserved network ranges are refused — a webhook pointing inside our network would be a security hole, not a feature.