Integrations

Webhooks

Push leads and events into Muntri, and subscribe to changes going out — every outbound delivery is signed and retried.

Back to Integrations API & Auth

Two directions

Inbound

An external system (a web form, a partner) POSTs data into Muntri to create a lead.
Outbound

Muntri POSTs to your endpoint whenever records change — you react in real time.

Inbound: push a lead in

Send a lead to Muntri from any external system. The lead runs through the same validation as everything else — deduplication, source tracking and automatic lead scoring.

Endpoint

curl -X POST "https://{slug}.muntri.com/api/webhooks/leads" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "first_name": "Jane",
    "last_name": "Doe",
    "company": "Acme Corp",
    "title": "VP Sales",
    "source": "website"
  }'

Provide at least one of email, first_name or last_name; the rest are optional.

What happens to an inbound lead

Deduplication check (a duplicate email is flagged, not blocked)
Source is recorded as webhook
Lead scoring runs automatically in the background
A lead activity is logged so it shows on the timeline

Register an endpoint and Muntri will call it whenever a subscribed event fires. You control the URL, choose which events to receive, and get a signing secret to verify every request.

Create an endpoint. Add your HTTPS URL and pick the events you care about. Muntri returns a signing secret (shown once).

Verify the signature. Every delivery carries an HMAC-SHA256 signature — check it before trusting the payload.

Handle the event. Read the payload and act. Return a 2xx; Muntri retries on failure.

Area	Events
Leads	`leads.created`, `leads.updated`
Contacts	`contacts.created`, `contacts.updated`
Accounts	`accounts.created`, `accounts.updated`
Opportunities	`opportunities.created`, `opportunities.updated`, `opportunities.deleted`
Quotes	`quotes.updated`
Comments	`opp_comments.created`
Conversations	`conversations.created`
Workflows	`workflow_runs.created`, `workflow_runs.updated`

Delivery flow

sequenceDiagram
  participant M as Muntri
  participant Y as Your endpoint
  M->>M: Record changes
  M->>M: Sign payload (HMAC-SHA256)
  M->>Y: POST with X-Muntri-Signature
  Y-->>M: 2xx OK
  Note over M,Y: Non-2xx or timeout → retried

Example payload

Deliveries carry an X-Muntri-Event header and a JSON body describing what changed:

{
  "action": "updated",
  "old_values": { "stage": "Proposal" },
  "new_values": { "stage": "Negotiation" }
}

Verifying the signature

Each request includes X-Muntri-Signature: sha256=<hex digest>, an HMAC-SHA256 of the raw body using your endpoint's secret. Compare it before processing:

import hmac, hashlib

def verify(body: bytes, signature: str, secret: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

Test and rotate

Send a test delivery from your endpoint's settings to confirm your receiver works, and rotate the secret anytime — the old one stops signing immediately.

HTTPS only

Outbound endpoints must be public HTTPS URLs. Internal or loopback addresses are rejected for safety.

Replaying a delivery

Failed (or successful) deliveries can be re-sent from the delivery log:

POST /api/webhook-endpoints/{endpoint_id}/deliveries/{delivery_id}/replay

The replay creates a fresh delivery record with the original payload and attempts it immediately — the response includes the receiving endpoint's status code.