On this page
Outbound webhooks push events from VGraple CRM to any HTTPS endpoint you control the moment they happen: a customer message, a new contact or lead, a stage change, a broadcast finishing, a conversation resolved, a form submitted. It is native and first-party: endpoints are created in Settings or through the API, payloads are signed with HMAC-SHA256, deliveries are retried and logged, and the same system powers the Zapier app.
What syncs
| Event | When it fires |
|---|---|
| message.received, message.sent | A customer message lands; a message is sent from the inbox, a flow, a broadcast or the API |
| contact.created, contact.opted_out | A contact is created from any source; a contact opts out |
| lead.created, lead.stage_changed | A lead is created; a lead moves stage on the board or by rule |
| broadcast.started, broadcast.completed, broadcast.paused, broadcast.failed, broadcast.reply | Broadcast lifecycle and replies attributed to a campaign |
| conversation.assigned, conversation.resolved, conversation.reopened | Assignment and stage changes on conversations |
| form.submitted | A VGraple CRM form is submitted |
Every payload carries the event name, a timestamp, the workspace ID and the object with its IDs and fields; the payload reference lists each schema.
Setup
- Go to Settings, then Webhooks, and click Add Endpoint.
- Enter the public HTTPS URL (private hosts and localhost are rejected) and an optional description.
- Tick the events to subscribe (at least one) and click Create Endpoint. Copy the
whsec_signing secret shown once. - Click Test on the endpoint row; a synthetic message.received event is delivered and the response logged.
- Verify
X-Signature-256on your side using the samples in the signature guide. - For the four broadcast lifecycle events, subscribe with
POST /api/v1/hooksusing an API key.
Who uses it
Teams with their own backend or a low-code platform (Make, Pabbly, n8n) who want VGraple CRM events to drive work elsewhere: tickets, invoices, spreadsheets, dashboards, Slack alerts, ERP updates. Zapier users get the same events through the Zapier app without touching signatures.
Payload shape
Every delivery is a JSON POST with the event name, an event ID, a timestamp, the workspace ID and an object whose shape depends on the event: a message with its conversation, contact, direction, type and content; a contact with its fields, tags and consent; a lead with pipeline, stage, value and source; a broadcast with counts; a conversation with assignment and stage; a form submission with answers. IDs are stable and can be used with the REST API to fetch more.
Reliability
Deliveries are attempted immediately and retried on a backoff schedule when your endpoint returns anything other than a 2xx or times out. Each attempt is logged with the status code and the first part of the response body, visible on the endpoint's delivery log, so debugging never requires guessing. Event IDs let you deduplicate if a retry arrives after a slow success. Endpoints can be disabled and re-enabled without losing configuration, and a Zapier-badged endpoint should be managed from Zapier rather than deleted here.
Security checklist
Verify the signature on every request before touching the payload, compare with a constant-time function, reject events older than a few minutes by their timestamp to blunt replay, and store the signing secret in your secret manager rather than in code. Rotate the secret from the endpoint's settings if it may have leaked; the old signature stops validating immediately. Because payloads carry customer names and numbers, your endpoint and anything it writes to fall inside your data protection scope.
Three recipes
- message.received -> your support system opens or updates a ticket -> agent replies in VGraple CRM.
- lead.stage_changed to Won -> your ERP creates a customer record and an invoice -> invoice link back through the REST API as a utility template.
- form.submitted -> Google Sheets via Make -> a Slack alert for high-value entries.
Limits and gotchas
- Endpoints must be public HTTPS; use a tunnel for local development.
- Retries stop after the schedule is exhausted; the log shows every attempt and response.
- Disable an endpoint to pause deliveries without losing its configuration; deleting a Zapier-badged endpoint breaks that Zap.
- Signature verification should use a constant-time comparison.
- Payloads contain contact PII; treat your endpoint as part of your data protection scope.
The webhooks guide covers each setting and the troubleshooting table.