Signed outbound webhooks and an interactive OpenAPI explorer. The documented endpoints, AI chat and notifications, use your signed-in session; there are no API tokens.
Configure outbound webhooks to receive real-time notifications when deals change. Each delivery is signed with HMAC-SHA256 over the JSON body using your webhook secret.
| Event | Description |
|---|---|
| deal.created | New deal added to pipeline. |
| deal.stage_changed | Deal moved to a different stage. |
| deal.at_risk | Deal crossed the at-risk threshold. |
| deal.closed_won | Deal successfully closed. |
| deal.closed_lost | Deal lost. |
Every webhook delivery has a stable envelope: id, event, timestamp, and a typed data block. Always verify the X-Webhook-Signature header before trusting the body.
{
"id": "evt_abc123",
"event": "deal.stage_changed",
"timestamp": "2026-05-10T12:00:00Z",
"data": {
"id": "clx123abc",
"name": "Acme Corp",
"oldStage": "proposal",
"newStage": "negotiation",
"value": 50000
}
}import crypto from "node:crypto";
const signature = req.headers["x-webhook-signature"];
const expected = crypto
.createHmac("sha256", webhookSecret)
.update(JSON.stringify(req.body))
.digest("hex");
const valid = crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
);
if (!valid) {
return res.status(401).end();
}The API reference runs Swagger UI against the documented endpoints. Sign in first; requests use your session.