Outbound webhooks (Zapier, Make, custom)

Every event carries a snapshot of the lead and the campaign that triggered it, so your endpoint never has to call back into ReplyMagnet for details. lead.created fires the first time a comment matches a live campaign; lead.email_captured fires when the download page's email field is submitted, and lead.phone_captured fires separately when the phone field is submitted; subscribe to either or both independently, since a campaign can gate on one, the other, or both; lead.followed fires once a follow is recorded, with a verification field that says exactly how confident that follow is: on Instagram, that's always api_verified, because it's checked against Instagram's own API rather than taken on trust.

test.ping is a separate test event, outside the four lead events above: the Test button in Settings sends one to a specific endpoint on demand, so you can confirm your server is receiving and verifying correctly before real traffic depends on it.

Adding an endpoint takes a URL, an optional label for your own reference, and a choice of which events it should receive; you don't have to subscribe to all four. Once saved, the secret used to sign every delivery to that endpoint appears one time in a confirmation panel; there's no way to view it again afterward; if it's lost, delete the endpoint and add a new one.

HTTPS is required for every endpoint in production: plaintext HTTP URLs are rejected outright, since a webhook secret sent to an insecure endpoint isn't actually secret.

Verification is standard HMAC: take the raw request body exactly as received (don't re-serialize it), concatenate the X-Magnet-Timestamp header value, a literal period, and the raw body, then HMAC-SHA256 that string with your endpoint's secret. The result, prefixed sha256=, must match the X-Magnet-Signature header. Settings shows a copy-paste Node snippet next to every endpoint once you've added one.

If you're wiring ReplyMagnet into Zapier or Make instead of your own backend, the platform-specific setup (catching the raw body before either tool's automatic JSON parsing) is written out step by step at /docs/zapier and /docs/make.

A failure is any non-2xx response or a request that never got a response at all (timeout, connection refused, DNS failure). ReplyMagnet doesn't give up after one miss: it retries with backoff, so a brief outage on your end doesn't lose an event. Only a run of 8 misses in a row trips the disable, and any single success anywhere in that run resets the counter back to zero.

Once disabled, the endpoint sits inert (events that would have gone to it simply aren't delivered there) until you click Re-enable in Settings → Integrations. Re-enabling doesn't replay what was missed; it resumes delivery for events from that point forward.

The gate is checked at the moment an event would be sent, not when an endpoint is created, so downgrading a workspace never deletes a webhook configuration, it just stops deliveries until the plan allows them again. Upgrading resumes exactly what was already set up, with nothing to reconfigure.