Webhooks (connect n8n, Zapier, Make)

Webhooks let HuntSales send an HTTP POST to a URL you own when something happens in your CRM, so you can trigger n8n, Zapier, Make, Slack, or your own service. Set them up under Admin, then Developer, in the Webhooks section: paste an https URL, tick the events you want, and save. The signing secret is shown once when you create the endpoint, so copy it then.

Events you can subscribe to: reply received, contact created, contact stage changed, contact assigned, campaign launched, campaign completed, email opened, email clicked, email bounced, contact unsubscribed, call completed, meeting scored, deal created, deal won, watchlist match, and credits low. Every event carries a small JSON payload with the ids and key display fields for that event (never full contact notes). A person added from People Search or the API whose email is still being looked up sends "contact created" when the lookup finishes, with the email it found (or none), so a Google Sheet row or a webhook gets the address rather than a blank.

Each delivery is signed so you can trust it came from us: the request carries an X-HuntSales-Signature header holding an HMAC-SHA256 of the exact body using your endpoint secret, plus an X-HuntSales-Event header naming the event and an X-HuntSales-Delivery header with the delivery's id. Verify by recomputing the HMAC on your side and comparing. A retry sends the same body and the same delivery id, so you can skip one you already have.

Delivery is best effort. Every event is written down for each endpoint before it is sent, then sent at once. When your endpoint cannot be reached, takes longer than 8 seconds to answer, or answers 429 or a 5xx error, we try again with growing gaps (a minute, 5 minutes, 15, 30, then 1, 2, 4 and 8 hours), up to 10 tries over about a day. Every try sends exactly the same body, so its signature matches too. Any other error answer is not retried. A redirect is never followed and not retried either: the delivery fails at once and its log says it was a redirect, so give the endpoint its final address. Very rarely an event can still be lost before it is written down, so for records that must not be missed, also read them back over MCP or the API. Open the Deliveries view on any endpoint (Admin, then Developer, then Webhooks) to see its newest 50 deliveries: delivered, waiting to send, failed with the time of the next try, or given up. An endpoint whose deliveries keep failing for about a day (23 hours and at least 5 tries) is turned off, its waiting tries are dropped, and the workspace's Super Admins are emailed; a Super Admin turns it back on with Turn back on once the address works again.

Prefer to manage endpoints from code (for example an n8n trigger node)? An API key can create, list, and delete webhook endpoints, and read an endpoint's recent deliveries, over the API, so a workflow can register its own endpoint automatically. The calls are documented at /docs/api. As in the app, where only a superadmin manages webhooks, only a Super Admin's key can do this, for every endpoint in the workspace; any other key is refused. An endpoint a key creates is saved as its owner's. Adding an endpoint emails the workspace's Super Admins the address it sends to, and adding or deleting one is recorded in the activity log. An endpoint added with an API key stops when that key is revoked, or when its owner is removed from the team: it is turned off, the Super Admins are emailed, and the activity log records it. It also stops sending, without being turned off, while the key's owner is no longer an active Super Admin (their role was changed, or they are paused), since only a Super Admin's key may manage webhooks; its events are not kept for later, and it sends again once the owner is a Super Admin again or is resumed. To keep it sending regardless, a Super Admin deletes it and adds it again in the app, where it belongs to the workspace. A Super Admin can turn it back on with Turn back on under Admin, then Developer, Webhooks. Because its key is gone, they are asked to confirm first: from then on it belongs to the workspace and keeps sending until a Super Admin turns it off or deletes it. One that was turned off for failing while its key still works keeps its link to the key when turned back on, so revoking the key later still stops it.

The other direction: to start an automation from Zapier, Make, n8n, a form or your own system, give the automation an Incoming webhook trigger and POST JSON to the URL it shows (https://huntsales.io/api/automation-hooks/ followed by its token). The token is the only key, so keep the URL private. Each automation takes up to 60 starts a minute. A body is at most 64 KB and must be JSON (a larger one is refused with 413, one that is not JSON with 400), and {{ }} in it is removed before any step reads it. Once the workspace's monthly automation run allowance is used up, a call is refused with 429 and starts nothing, and Run history notes it once a month.

Note: task due-date events are not available yet.