Webhooks push events out of EmpireVault to systems you run - the mirror image of the REST API. When something happens (a lead is created, a form is submitted, a deal is won), EmpireVault sends an HTTP POST with the event's details to every endpoint subscribed to that event.
Navigate to Platform > Integrations > Webhooks (admin only) and click Add endpoint. Give it a label, an HTTPS URL, and tick the events it should receive. When you save, EmpireVault shows the endpoint's signing secret once - copy it then, because it's masked afterwards.
Every delivery is signed: the X-EmpireVault-Signature header carries a signature computed from the payload and your endpoint's signing secret. Verify it on your side before trusting the payload, so a request that didn't come from EmpireVault is rejected. If the secret is ever exposed, click Regenerate secret - the old secret stops working immediately and the new one is shown once, just like at creation.
Every delivery is an HTTP POST with a JSON body in a common envelope: event_type, delivered_at, tenant_id, object_type, object_id, and an event-specific data object. A deal moving stage, for example, arrives as:
{"event_type": "deal_stage_changed", "delivered_at": "2026-07-09T14:30:00Z", "tenant_id": "EV1234", "object_type": "Deal", "object_id": "9f4c2a58-...", "data": {"to_stage": {"id": "...", "label": "Proposal"}}}
Subscribable events: lead_created, lead_status_changed, deal_stage_changed, deal_won, deal_lost, ticket_created, ticket_status_changed, form_submission, quote_accepted, quote_declined, and contact_tagged. Status-change events carry the new status in data; events with no extra context deliver an empty data object. Deliveries fired by an automation rule's "Call webhook" action use event_type: "automation_rule", with the rule's id and name, the trigger that fired it, and the record inside data. Test sends use event_type: "test".
Click Send test next to an endpoint to deliver a signed test payload immediately and confirm your verification end to end. A 2xx response marks a delivery as delivered; 4xx responses are treated as permanent and not retried; network errors, timeouts, and 5xx responses are retried automatically with increasing backoff, up to five attempts, so a brief outage on your side doesn't lose events. After ten consecutive failed deliveries an endpoint is disabled automatically - re-enable it from this page once your receiver is healthy. Deliveries are throttled at 60 per endpoint per hour. An endpoint can be removed at any time; removal stops all future deliveries to it.
Besides the always-on event subscriptions here, CRM automation rules can call a webhook as an action - useful when you want a webhook to fire only under specific conditions. See CRM Automations.
Was this article helpful?