Signed webhook · Available
If it can send a request, it can be a leaderboard.
A deal won, a ticket resolved, a filing accepted. Post it as JSON with two fields and it is rankable immediately, named whatever your business calls it, with no integration to wait for.
- Status
- Available
- Authenticated with
- A per-organization secret. Each request carries a timestamp and an HMAC-SHA256 signature over the raw body, so a captured request cannot be replayed.
- Becomes
- a metric with that name · the guarantee it counts once · the person credited · readable by your rules
What it sends
What arrives, and what it becomes on a board
| When | Becomes | Worth knowing |
|---|---|---|
| eventType | a metric with that name | Required. deal_won, ticket_resolved, filing_accepted: the name you send is the name on the board. |
| dedupeKey | the guarantee it counts once | Required. Send the same key twice and the second is ignored, so a retry or a re-sync is always safe. |
| externalId | the person credited | Optional. An email by default, or an identity in a namespace you name; unmatched ids wait on the identities page. |
| anything else | readable by your rules | amount, region, priority: kept on the event so a bonus can key off it without us knowing what it means. |
Three answers: 202 means the signature verified and the event is queued, 400 means it was not JSON, and 401 covers a bad signature, a stale timestamp and an unknown organization alike, deliberately the same, so a stranger cannot tell which.
Setting it up
Three steps, and none of them is a ticket to us.
- 01
Copy the endpoint and secret
Both are on the Connect screen inside the product. Rotating the secret takes effect immediately.
- 02
Send one event
A bash and a Node example are on the docs page; each is a dozen lines and needs no client library.
- 03
Build a board on it
The event type is a metric the moment it lands. Pick it in the board builder and rank on it the same afternoon.
What it will not do
The refusals, in writing.
- Accept an unsigned request, or one older than the replay window.
- Count a retry. The dedupe key is the whole of the guarantee, and it is yours to choose.
- Tell a stranger whether an organization exists. Every authentication failure is the same 401.
- Need a schema from us. Send the fields your business has; the two we require are the only two.
Questions
The ones that come up
What should I use as the dedupe key?
The thing that makes the act unique in your system: the ticket id and the status it reached, the opportunity id and the stage. Name the act, not the request, so a re-sync of the same act is ignored.
How fast does it show up?
Within seconds. The event is verified, queued, and scored; the board reads a rollup, so it is as fast on three years of history as on day one.
Can somebody on the team do this without engineering?
Most helpdesks and CRMs can fire a webhook on a status change with a few fields, from their own settings. If yours can, it is an afternoon; if not, it is a short script for whoever has written one before.
What happens to an event for someone you do not know?
It is kept and shown on the identities page waiting to be linked. Link the id to a person and the work is attributed, including everything sent before the link.