Lead Webhooks

Lead Delivery sends every lead your site's forms capture to the destinations you choose — Zapier, Make, n8n, GoHighLevel, HubSpot, or any endpoint that accepts webhooks. This page is the integration contract: what the request looks like, how it is signed, and what happens when a delivery fails. For the product overview, see Lead Delivery.

Set up a destination (the user half)Copy Anchor Link

A Director sets this up once per destination, at Website Settings, under the Integrate With Other Apps tab in the When someone contacts you section:

1. Click Add Destination under Webhook Destinations.
2. Give it a Label, set Enabled, pick the Method (POST by default, PUT available), and paste your Webhook URL.
3. Under Send for these forms, tick which forms feed this destination — all forms or specific ones.
4. Build the Field Mapping with Add Field pairs (lead field → destination key), and set a Signing Secret so each request is signed. Save.

Optional extras per destination: Static Fields (fixed key/value pairs merged into every payload) and Custom Headers. The signing secret is optional — leave it empty and requests arrive unsigned. And nothing sends until a destination exists: zero destinations, zero outbound requests.

The requestCopy Anchor Link

Each matching lead produces one HTTP request to the destination's URL:

• Method: POST (or PUT, per destination).
• Content-Type: application/json.
• Body: a JSON object whose keys are the destination's own mapped keys. The values come from the lead fields below — anything you did not map simply is not included unless you add it. Static fields are merged in first; a mapped, non-empty lead value overrides a static one.

Payload fieldsCopy Anchor Link

These are the 25 source fields available to map:

Two formatting rules: empty values are omitted from the payload rather than sent as empty strings, and multi-value fields are flattened to comma-joined strings.

HeadersCopy Anchor Link

When a destination has a signing secret, each request carries four headers:

These four are set by the platform itself, after your custom headers, so a custom header cannot shadow or spoof them.

Verifying the signatureCopy Anchor Link

The signature is HMAC-SHA256 over timestamp.body — the raw X-UCRE-Timestamp value, a period, and the exact raw request body as received, keyed with the destination's signing secret. Verify against the raw body before any framework parsing or re-serialization.

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyLeadWebhook(rawBody, headers, secret) {
  const expected =
    "sha256=" +
    createHmac("sha256", secret)
      .update(headers["x-ucre-timestamp"] + "." + rawBody)
      .digest("hex");
  const received = String(headers["x-ucre-signature"] ?? "");
  const a = Buffer.from(expected);
  const b = Buffer.from(received);
  return a.length === b.length && timingSafeEqual(a, b);
}

Two more checks worth making on your side:

• Freshness: reject requests whose X-UCRE-Timestamp is older than your own replay window.
• Deduplication: map ucre_lead_id to a key in Field Mapping, then dedupe on it — it is stable across retries. It is only in the body if you map it. X-UCRE-Event-Id identifies a single delivery attempt, so a later re-delivery can carry a new one.

RetriesCopy Anchor Link

Delivery succeeds on any 2xx response. Anything else — a non-2xx status, a timeout (15 seconds), or a connection error — schedules a retry:

• Three attempts total, with backoff: the first retry after about a minute, the second after about two.
• Redirects are not followed, so point the webhook URL at the final endpoint.
• If all three attempts fail, the failure is recorded on the lead's activity record in your dashboard — the lead is never dropped silently.

Behavior worth knowingCopy Anchor Link

• Creation only. A lead dispatches when it is created — editing or re-saving a lead never re-sends it. Newsletter signups flow through the same pipeline.
• Per-form opt-in. Each destination receives only the forms ticked for it, so different destinations can take different slices of your leads.
• No secret, no signature. An unsigned request is byte-identical to a signed one apart from the four headers — verify only what you asked to be signed.

Test your endpointCopy Anchor Link

Submit a test lead the way a visitor would: open your own site, fill in one of your own forms, and watch the request arrive at your endpoint. That creates a real lead and dispatches like any other — which is exactly what you want to verify end to end, signature and all.