18 event types — push data anywhere

Setup

Create an API subscription, then verify signed deliveries. Settings does not contain a separate webhook builder.

POST /api/v2/webhooks
Authorization: Bearer YOUR_API_TOKEN
Content-Type: application/json

{"url":"https://example.com/kolvera-events","events":["contact.created"],"secret":"YOUR_RECEIVER_SIGNING_SECRET"}

Use GET /api/v2/webhooks for your subscriptions and supported events. Use PATCH or DELETE /api/v2/webhooks/<id> to manage a subscription. OAuth credentials require webhooks:manage. Supply a signing secret and verify X-Kolvera-Signature against the raw request body; deduplicate deliveries using their event ID.

Events reference

All 18 event types and when they fire.

Delivery coverage varies by workflow. contact.created, contact.updated, and company.updated are emitted primarily by core API writes; company.created is emitted when API contact creation creates a company. UI changes and imports can bypass these events. contact.enriched covers API email lookup, not phone lookup. For a complete local copy, reconcile periodically through the REST API; treat events as change hints.

Payloads and delivery

Every POST body has this envelope. id stays the same across retries, so use it to deduplicate. data varies by event:

{"id":"evt_...","event":"enrolment.complete","timestamp":"2026-10-05T00:00:00+00:00","data":{"campaign_id":"...","enrolled":3}}

enrolment.complete means successful campaign enrolment; campaign.completed means one contact finished the sequence. No event fires for each email sent.

Return 2xx to acknowledge. Kolvera retries HTTP 408, 425, 429, 500, 502, 503, and 504 after 30 seconds, 2 minutes, 10 minutes, 30 minutes, and 60 minutes, up to five retries. Other 4xx responses are not retried. Ten failed events disable a subscription; retry attempts for one event count as one failure. If the task broker is unavailable, the thread fallback makes one attempt without retries.

Signature verification

Verify that requests come from Kolvera, not a third party.

# Python — verify an incoming webhook request
import hmac, hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    if not isinstance(signature, str) or not signature.startswith("sha256="):
        return False
    digest = signature[7:]
    if len(digest) != 64 or any(c not in "0123456789abcdef" for c in digest):
        return False
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).digest()
    return hmac.compare_digest(expected, bytes.fromhex(digest))

// Node.js — verify an incoming webhook request
const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  if (typeof signature !== 'string' || !/^sha256=[0-9a-f]{64}$/.test(signature)) return false;
  const expected = crypto.createHmac('sha256', secret).update(payload).digest();
  const received = Buffer.from(signature.slice(7), 'hex');
  return crypto.timingSafeEqual(expected, received);
}

No-code integrations

Webhooks work natively with the most popular automation platforms.

Example automations

Common patterns to get you started.

See also