lead_created
Sent after a lead is saved when the company is on a paid plan and has enabled a valid HTTPS destination and signing secret. Delivery failure does not roll back lead creation.
Developer & API documentation
Signed Lead Webhooks
CardIQ supports one configured outbound lead workflow. It does not expose a general webhook catalogue or inbound webhook API.
Availability and events
webhook_test
Sent on administrator request with company-only test data and no lead or employee personal data.
Request and signature
CardIQ sends POST with Content-Type: application/json, X-CardIQ-Event, and X-CardIQ-Signature. The signature is the lowercase hexadecimal HMAC-SHA256 digest of the exact raw request body using the company webhook secret. Validate against the unmodified bytes with a constant-time comparison before parsing or processing.
lead_created fields
The implemented payload contains event_type, company_id, employee_id, employee_name, lead_name, lead_email, lead_phone, lead_message, source, employee_profile_url, and created_at. Treat all values as untrusted input and personal data. The test payload instead contains event_type, company_id, company_name, test, message, and sent_at.
Delivery, retry and operations
A 2xx response is success. Where the retry migration is installed, failed lead_created deliveries are queued for up to three retry attempts using implemented delays of 5 minutes, 30 minutes, and 2 hours. Test events are not queued. Administrators can inspect recent delivery metadata and manually retry queued failures. No receiver acknowledgement schema, ordering guarantee, duplicate-free guarantee, or public throughput limit is promised; make processing idempotent.
Continue reading
Control how employees represent your company externally
Explore the CardIQ platform or review the workflow from verification through identity deactivation.
See how CardIQ works View pricing