Webhooks

Owner and Company admin open Company admin → Sales & integrations → Integrations → API and webhooks. A webhook sends an HTTPS POST with JSON to your system each time a chosen event happens.

#Create a webhook

1. Under Webhooks, select New webhook.
2. Enter a Name and the URL. HTTPS only. Internal and private network addresses are blocked.
3. Under Events, tick what to send: lead.created, deal.created, deal.stage_changed, deal.won, deal.lost, contact.created, contact.updated, company.created, company.updated.
4. Select Create webhook, copy the signing secret and select I saved it. Use it to check the X-Dromix-Signature header on each request. It is shown only now; you can rotate it later.

Select Send test to send a ping event right away.

#Check the signature

Each request carries the headers X-Dromix-Event, X-Dromix-Event-Id, X-Dromix-Delivery, X-Dromix-Timestamp (Unix seconds) and X-Dromix-Signature. The signature is sha256= + HMAC-SHA256(secret, {timestamp}.{body}). Compute it on your side, compare it, and reject requests older than 5 minutes.

The same event can arrive twice after a retry. Use X-Dromix-Event-Id to skip duplicates.

If the secret leaks, select Rotate secret. The old secret stops working at once. Update your receiver right after.

#Deliveries and retries

Select Delivery log to see each delivery with its status, attempts and the next try. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h. A webhook is turned off after 50 failures in a row or when the receiver answers 410 Gone.

Turn the webhook back on with On once your receiver works again.