Webhooks and signatures
Getting told when a campaign run ends, checking that the message came from ACR, and what happens when a delivery fails.
Last reviewed November 7, 2026
Events
An admin adds one endpoint per event and URL under Webhooks, on the Endpoints tab. The URL must be HTTPS and reachable from the internet.
| Event | Sent when |
|---|---|
lead.campaign.completed | A run ends. That includes a run stopped after the shopper was reached, such as one cancelled or ended by an order. |
lead.campaign.cancelled | A run is stopped before the shopper was ever contacted. The payload carries the reason in plain words. |
Both carry the run's status, lead_id, lead_campaign_id (the run's id) and ended_at. Test runs send these events too.
Checking the signature
Each delivery is a JSON POST with an X-ACR-Signature header, signed with the endpoint's secret. The secret is shown once, when the endpoint is created.
X-ACR-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">Recompute the HMAC on your side and reject deliveries that do not match or are old.
Failures
Answer with any 2xx within 5 seconds. A failed delivery is tried four more times, at one minute, one hour, one day and one week after the failure, and is then marked failed. The Deliveries tab shows each delivery and its payload, and an admin can send a failed or retrying one again.
Ten 401 answers within an hour switch the endpoint off and raise a notification. Fix its authentication, then switch it back on from the Endpoints tab.