Webhooks

Webhooks are the escape hatch. When FoxFlow doesn't integrate with something directly, this is how you connect it anyway.

What it does

When something happens to a lead, FoxFlow sends an HTTP POST to a URL you provide, carrying the details as JSON.

You can create up to 5 endpoints, each listening for the events it cares about and, optionally, only for specific flows.

The events

lead.converted is a convenience: it's a status change, but it's the one you probably want to act on. If you subscribe to both, you'll get both for a conversion.

Setting one up

Organization Settings → Integrations → Webhooks, then add an endpoint:

• URL — must be HTTPS.
• Events — which of the three you want.
• Flows — leave empty for all flows, or restrict it.

There's a send test action so you can confirm your receiver works before relying on it, and you can rotate an endpoint's secret at any time.

What arrives

A POST with JSON in this shape:

{
  "id": "delivery-id",
  "event": "lead.created",
  "created_at": "2026-08-19T14:02:11.000Z",
  "data": {
    "lead": {
      "id": "abc123",
      "flow_id": "flow456",
      "flow_name": "Connect Cards",
      "name": "Sarah Jones",
      "email": "sarah@example.com",
      "phone": "+15551234567",
      "status": "init_status",
      "status_label": "New lead",
      "source": "meta_lead_ad",
      "created_at": "2026-08-19T14:02:10.000Z"
    }
  }
}

source tells you where the lead came from — a Meta lead ad, a FlowForm submission, the public form, or a manual entry. On a status change you also get the previous status and its label.

Verifying the request

Each request carries headers identifying the event and delivery, plus a signature. The signature is an HMAC-SHA256 of a timestamp and the request body, computed with your endpoint's secret.

Check it before trusting the data. That's what stops anyone who discovers your URL from posting fake leads at it.

Retries and failure

FoxFlow allows about five seconds for your endpoint to respond, then retries failures with growing gaps — a few minutes, then longer, spread over several hours. Five attempts in total.

An endpoint that keeps failing is eventually disabled automatically, after around twenty consecutive failures. That's a safety valve, not a punishment: it stops a dead URL being retried forever. Fix it and re-enable.

Delivery attempts are logged, so you can see what was sent and how your endpoint responded.

What people actually use them for

What it won't do

• It's outbound only. You can't post leads into FoxFlow this way — use a form for that.
• It doesn't send contact events, only lead events.
• It won't deliver to plain HTTP.