Webhooks

Setup

1. Go to Settings → Developer → Webhooks
2. Click Add endpoint
3. Enter your HTTPS endpoint URL
4. Select the event types you want to receive
5. Copy the generated webhook secret for signature verification

Payload format

All webhook payloads are JSON objects with a consistent envelope:

{
  "id": "evt_01HXK9P2Y3Z4A5B6C7D8E9F0",
  "event": "contact.created",
  "created_at": "2026-03-16T10:23:41Z",
  "tenant_id": 12,
  "data": {
    "id": 1043,
    "first_name": "Jane",
    "last_name": "Doe",
    "email": "jane@acme.com",
    "stage": "prospect",
    "pipeline_type": "sales"
  }
}

Signature verification

Every request includes an X-PushButtonCRM-Signature header containing an HMAC-SHA256 signature of the raw request body, signed with your webhook secret. Always verify this signature before processing the payload.

// Node.js verification example
import crypto from "crypto";

export function verifyWebhook(rawBody: string, signature: string, secret: string) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody, "utf8")
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected, "hex")
  );
}

Retry policy

PushButtonCRM retries failed deliveries (non-2xx or timeout) with exponential backoff:

After 5 failed attempts the delivery is marked as failed. You can replay failed deliveries from the Webhooks dashboard.