Webhooks and automation connectors

Register outbound webhooks for CRM events, verify their signature, and use Zapier-style automation rules to connect Slack, Google Sheets, Google Calendar or any HTTP endpoint.

There are two related but distinct mechanisms:

Outbound webhooks (/api/v1/webhooks) — register a URL once, get an HTTP POST for every event you subscribed to, forever.
Automation rules (/api/v1/automations/rules, and the in-app Automations builder) — a When/If/Then rule engine. A rule can trigger on an inbound webhook, and its actions include posting a one-off outbound webhook, a Slack message, a Google Sheets row, or a Google Calendar event.

Outbound webhooks

Requires the webhooks:manage scope.

Register a webhook

POST /api/v1/webhooks

{
  "url": "https://your-app.example.com/hooks/avensa",
  "enabled_events": ["contact.created", "deal.won", "property.updated"],
  "description": "Sync new contacts and won deals into our system"
}

List / get / delete

GET    /api/v1/webhooks
GET    /api/v1/webhooks/{id}
DELETE /api/v1/webhooks/{id}

Delivery logs

GET /api/v1/webhooks/{id}/deliveries

{
  "data": [
    {
      "id": "...",
      "webhook_id": "...",
      "event_type": "contact.created",
      "status": "success",
      "response_code": 200,
      "response_time_ms": 143,
      "error_message": null,
      "created_at": "2026-09-02T18:00:00.000Z"
    }
  ]
}

Available events

property.created          property.updated          property.deleted          property.status_changed
unit.created               unit.updated               unit.deleted
contact.created             contact.updated             contact.deleted
deal.created                 deal.updated                 deal.stage_changed          deal.won          deal.lost
task.created                 task.updated                 task.completed
viewing.created              viewing.updated              viewing.cancelled
document.created             document.signed
note.created
lead.inbound_received
commission.created           commission.updated
expense.created               expense.updated               expense.deleted
export.completed
custom_field.updated

The current, authoritative list (this catalog is generated from the same source, and is also public without authentication) is:

GET /api/v1/automations/catalog

Verifying the signature

Every delivery is a POST with:

Content-Type: application/json
X-Webhook-Signature: t=1725292800,v1=<hmac-sha256-hex>
X-Webhook-Timestamp: 1725292800
X-Webhook-Id: <event id>
User-Agent: Avensa-Webhooks/1.0

The signature is HMAC-SHA256(secret, "<timestamp>.<json body>"). Verify it, and reject requests where the timestamp is older than 5 minutes (default), to guard against replay. The endpoint secret is shown once when the webhook is created — store it like any other credential.

Automation rules (Zapier-style)

Automation rules live in Automations → Rules in the app and are also manageable through the API (automations:read / automations:manage scopes):

GET  /api/v1/automations/catalog        (public — triggers, actions, condition operators, webhook events)
GET  /api/v1/automations/rules
POST /api/v1/automations/rules          (creates as a draft; requires name + definition)
PATCH /api/v1/automations/rules/{id}    (activate/pause)

A rule is created in draft status; activate it with PATCH once reviewed. POST requires automations:manage; a plan limit on active rules returns 403.

Triggers

contact_created, contact_lifecycle_changed, deal_created, deal_stage_changed, deal_won, deal_lost, property_price_changed, viewing_completed, document_uploaded, document_review_requested, document_expiring, document_signed, inactivity_contact, inactivity_deal, manual_trigger, and webhook — an inbound webhook URL you can call from any external system to fire the rule.

Actions (the connector surface)

Alongside CRM actions (create a task, change a deal stage, add a tag, …), the action catalog includes:

Action	What it does
`webhook`	Post the triggering record to an external URL — the outbound-webhook equivalent scoped to one rule, with an optional per-action secret and "include context" toggle.
`http_request`	A generic outbound HTTP call, for connecting to APIs that don't fit the webhook shape.
`slack_message`	Post a message to your team's Slack channel via the Incoming Webhook connected under Settings → Integrations → Automations. The step fails if Slack isn't connected there.
`google_sheets_append_row`	Append the record as a row in a connected Google Sheet.
`google_calendar_create_event`	Put an event on the connected Google Calendar.
`create_record` / `update_record` / `delete_record` / `find_records`	Generic CRM record operations, usable as building blocks for more complex flows.
`if_else`, `filter`, `iterator`, `delay`, `form`	Flow-control steps.

Connect Slack and Google (Sheets/Calendar) once, account-wide, under Settings → Integrations → Automations; every rule's slack_message/google_sheets_append_row/google_calendar_create_event steps then reuse that connection.

Triggering a rule externally

A rule whose trigger is webhook gets its own inbound URL. Call it from Zapier, Make, or any script to fire the rule — this is the reverse direction of the outbound webhooks above (external system → Avensa, instead of Avensa → external system). Triggering with an API key requires the automations:trigger scope.

Outbound webhooks