Skip to main content

Webhooks: Real-Time Signal Delivery

Set up webhooks for automatic signal delivery, manage subscriptions, verify signatures, and troubleshoot failed deliveries.

Written by Kyle Schuster
Updated today

Note: Webhook delivery is currently waitlisted and expected to be available mid to late May 2026. Test data is available in the interim so you can build and validate your integration ahead of launch. Contact sales to join the waitlist and request test data.

Overview

Autobound webhooks deliver signals to your endpoint in real time via HTTP POST as new signals are ingested. This eliminates the need for polling or cron jobs.

Key Benefits

  • Lower latency: Signals arrive immediately rather than on fixed schedules

  • No wasted credits: Credits only consume upon actual delivery, not subscription management

  • Simpler architecture: No need to maintain cursors or polling loops

Creating a Webhook Subscription

Endpoint: POST https://signals.autobound.ai/v1/webhooks

Credit cost: Free

Parameters

  • url (required) — HTTPS endpoint to receive events. Must be publicly accessible.

  • signal_types (optional) — Array of signal types to filter delivery

  • description (optional) — Human-readable label for this subscription

Important: The response includes a signing_secret. Save this immediately. It is only shown once but can be rotated later.

Event Payload

Each webhook delivery includes these headers:

  • Content-Type: application/json

  • x-autobound-signature: sha256=<hmac>

  • x-autobound-event: signal.created

  • x-autobound-delivery: del_xyz789

The body contains a standard signal object with event metadata, company data, contact data, and the signal-specific data payload.

Respond with any 2xx status to acknowledge receipt. Any other response triggers exponential backoff retries.

Signature Verification

Always verify the x-autobound-signature header before processing an event. Use crypto.timingSafeEqual() (not ===) when comparing HMAC values to prevent timing attacks.

Managing Subscriptions

  • List all: GET /v1/webhooks

  • Get one: GET /v1/webhooks/:id

  • Update: PATCH /v1/webhooks/:id (modify URL, types, or pause status)

  • Delete: DELETE /v1/webhooks/:id

All webhook management endpoints are free and do not consume credits.

Testing and Backfilling

  • Test endpoint: POST /v1/webhooks/{id}/test sends a synthetic event to verify your integration

  • Replay historical: POST /v1/webhooks/{id}/replay with date range and signal type filters to backfill past signals

Note: Backfill (replay) operations consume credits at the same rate as live deliveries.

Delivery Logs and Troubleshooting

View recent delivery attempts via GET /v1/webhooks/:id/deliveries.

Failed deliveries that exhaust all retries are moved to a dead-letter queue. Access it at GET /v1/webhooks/:id/dead. You can replay individual failures using the same replay endpoint.

Secret Rotation

If your signing secret is compromised, rotate it immediately with POST /v1/webhooks/:id/rotate-secret. Update your verification code before rotating to avoid dropping legitimate events during the transition.

Did this answer your question?