Webhooks: events, payload examples and retries

Draft — written from product facts + domain knowledge; UI labels to be verified before publishing.

Webhooks push campaign events to a URL you control the moment they happen, so you do not have to poll the API. Use them to route replies to your CRM, alert your team in Slack or suppress bounced addresses in other tools.

Prerequisites

• An HTTPS endpoint that accepts POST requests and returns a 2xx status within 10 seconds.
• Owner or Admin role in the workspace.

Available events

Steps

1. Click Settings in the bottom-left corner, then open Integrations → Webhooks.
2. Click Add Webhook.
3. Enter the Endpoint URL (HTTPS only).
4. Tick the Events you want. Start with lead.replied and lead.bounced; add the rest when your handler is ready for them.
5. Optionally restrict the webhook to specific Campaigns. Leave empty to receive events from all campaigns in the workspace.
6. Click Save. OutreachFox generates a Signing secret. Copy it; you use it to verify that requests really come from OutreachFox.
7. Click Send test event to deliver a sample lead.replied payload to your endpoint and confirm you see a 200 in the Deliveries log.

Payload format

Every event uses the same envelope:

{

"id": "evt_01J8XK3Q7M2P",

"type": "lead.replied",

"created_at": "2026-09-21T09:14:02Z",

"workspace_id": "ws_4f2a",

"data": {

"campaign": { "id": "cmp\_8c1d", "name": "Q4 SaaS founders" },

"lead": {

  "id": "lead\_2b9e",

  "email": "jane@example.com",

  "first\_name": "Jane",

  "company": "Example Inc",

  "status": "replied"

},

"mailbox": { "id": "mbx\_71aa", "email": "tim@yourdomain.com" },

"reply": {

  "subject": "Re: Quick question",

  "snippet": "Sure, send over a time.",

  "category": "Interested",

  "sentiment": "positive",

  "received\_at": "2026-09-21T09:13:55Z"

}

}

}

lead.bounced replaces reply with bounce: { "type": "hard", "reason": "550 5.1.1 user unknown" }. campaign.paused carries data.campaign plus reason: "bounce_rate_limit" | "manual" | "mailbox_disconnected". email.sent carries data.step (step and variant), data.subject and data.message_id. lead.unsubscribed carries source: "link" | "manual" | "reply".

Verifying signatures

Each request includes an X-OutreachFox-Signature header: t=<unix timestamp>,v1=<hex HMAC-SHA256>. Compute HMAC-SHA256(secret, "<timestamp>.<raw body>"), compare it to v1 with a constant-time comparison, and reject requests whose timestamp is more than 5 minutes old.

Retries

• A delivery is successful when your endpoint returns any 2xx within 10 seconds.
• On timeout or a non-2xx response, OutreachFox retries with backoff: 1 min, 5 min, 30 min, 2 h, 6 h, 24 h (six attempts over roughly 33 hours).
• Deliveries can arrive out of order and, rarely, twice. Store id and ignore events you have already processed.
• If every delivery fails for 7 days, the webhook is disabled and the workspace Owner is emailed. Re-enable it under Settings → Integrations → Webhooks after fixing the endpoint.

Tips

• Acknowledge immediately and process in a background job; do not call your CRM inside the request handler.
• Use one webhook per destination rather than one giant handler.
• The Deliveries tab shows the last 30 days of attempts with status, response code and body. Click Redeliver to resend a single event.

Troubleshooting

• No events arrive: check that the endpoint is public, HTTPS and not blocking OutreachFox's IPs. Send a test event and read the response in Deliveries.
• Signature mismatches: verify against the raw request body, not a re-serialised version.
• Duplicate CRM records: deduplicate on data.lead.id, not on email address.

Related articles

• API keys and authentication
• Connect OutreachFox to Zapier and Make
• Sync leads and replies with HubSpot, Pipedrive and Salesforce
• Slack notifications for replies and campaign events
• AI Reply Categorization Guide
• Enable Email Bounce Protection