> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leadscoutapp.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Webhooks: send LeadScout events to external systems
> Register webhook endpoints to receive real-time HTTP payloads when events happen in LeadScout, so your own tools stay automatically in sync.
Webhooks let you push data out of LeadScout the moment something happens — a prospect's status changes, an appointment is created, a knock is logged. Instead of polling the API, LeadScout sends an HTTP `POST` request to a URL you control. Use webhooks to keep a CRM updated, trigger custom workflows, write to a database, or notify other internal tools without any manual export step.
Creating and managing webhooks requires the **admin** role. Team members with other roles can see the LeadScout data that webhooks deliver to your external systems, but they cannot register or modify webhooks.
## Register a webhook
Go to **Settings → Integrations → Webhooks** and click **Add Webhook**.
Provide the following:
| Field | Description |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **Name** | A label for this webhook (e.g., "HubSpot Sync") |
| **URL** | The HTTPS endpoint that will receive event payloads |
| **Secret key** | A key used to sign payloads so you can verify they came from LeadScout. LeadScout generates one automatically if you leave this blank. |
After saving the webhook, add one or more event registrations. Each registration tells LeadScout which event type to listen for and how to deliver it.
Save your registrations. LeadScout begins delivering payloads for any matching events immediately.
## Event registrations
Each webhook can subscribe to multiple events. When you add an event registration, you configure:
| Field | Description |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ |
| **Event** | The event type to listen for (see list below) |
| **Filter** | Optional JSON filter to narrow which records trigger the event |
| **Delay minutes** | How many minutes after the event fires before the payload is sent (0 for immediate) |
| **Trigger mode** | `automatic` — fires without user action; `manual` — a button appears in the LeadScout UI that team members click to send the payload |
| **Manual trigger button text** | Label for the button when trigger mode is `manual` |
### Available event types
The `event` field accepts any string your system defines. Common events used with LeadScout include prospect lifecycle events (such as status changes), appointment events (created, updated, canceled), and knock events (logged). Use the event name that matches what your external system expects to receive.
Each webhook can only register a given event type once. If you need to send the same event to two different URLs, create two separate webhooks.
## Verifying webhook signatures
Every payload LeadScout sends includes a signature so you can confirm it came from LeadScout and has not been tampered with. The signature is an HMAC of the payload computed using your webhook's secret key and is sent in the `X-LeadScout-Signature` header.
To verify a payload on your server:
Read the `X-LeadScout-Signature` header value from the incoming request.
Use your webhook's secret key and the raw request body to compute an HMAC-SHA256 digest. Compare it to the value from the header.
If the signatures do not match, discard the request — it was not sent by LeadScout or was modified in transit.
```javascript node.js theme={null}
const crypto = require('crypto')
function verifySignature(rawBody, signature, secretKey) {
const expected = crypto
.createHmac('sha256', secretKey)
.update(rawBody)
.digest('hex')
return crypto.timingSafeEqual(
Buffer.from(expected, 'hex'),
Buffer.from(signature, 'hex')
)
}
```
```python python theme={null}
import hmac
import hashlib
def verify_signature(raw_body: bytes, signature: str, secret_key: str) -> bool:
expected = hmac.new(
secret_key.encode(),
raw_body,
hashlib.sha256
).hexdigest()
return hmac.compare_digest(expected, signature)
```
Store your secret key securely — treat it like a password. If you suspect it has been compromised, delete the webhook and create a new one with a fresh secret.
## Example webhook payload
LeadScout sends a `POST` request with a JSON body. The `data` field contains the full record for the entity that triggered the event.
```json example payload theme={null}
{
"event": "prospect.status_changed",
"entityId": "prospect_4821",
"data": {
"id": 4821,
"address": "1204 Birchwood Dr",
"status": "interested",
"updatedAt": "2026-05-15T14:32:00.000Z"
},
"triggeredAt": "2026-05-15T14:32:00.000Z"
}
```
## Viewing delivery logs
LeadScout keeps a log of every event delivery attempt for each webhook. Go to **Settings → Integrations → Webhooks**, click a webhook, then open **Logs** to see:
* Delivery timestamp
* HTTP status code returned by your endpoint
* The payload that was sent
* The response your server returned
Logs are paginated and show the 50 most recent deliveries by default.
## Edit or delete a webhook
To update a webhook's name or URL, go to **Settings → Integrations → Webhooks**, click the webhook, and save your changes. To remove a webhook entirely, click **Delete** — this permanently stops all future deliveries for that webhook and its registrations.