ToolbenchDocs
Get a key

API

Webhooks

HTTPS event delivery (lead.created, lead.booked, review.created). Verify Toolbench-Signature on every POST.

Register a public HTTPS endpoint with POST /webhooks using your Bearer customer API token. Toolbench POSTs JSON when something happens in the shop — usually within about one minute, with retries and backoff if your endpoint errors.

Manage subscriptions

  • GET /webhooks — list URL and event types (signing secret is not returned again).
  • POST /webhooks — register a target; response includes signing_secret once.
  • DELETE /webhooks/{id} — remove a subscription (write-mode token).
URL rules
Webhook URLs must be public HTTPS. Private IPs are rejected and redirects are not followed.

Events

  • lead.created — a new lead row exists after a missed call (same shape as GET /leads{id}.lead).
  • lead.booked — a lead is marked booked (owner action, voice, or external scheduler).
  • review.created — a new Google review is stored (same fields as one row from GET /reviews).
  • pending_action.created — coming soon; not emitted yet.

Payload

Every delivery is one object:

event body
{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "lead.created",
  "created_at": "2026-10-16T12:00:00.000Z",
  "account_id": "…",
  "data": { "lead": { "id": "…", "status": "new", "source": "missed_call", "created_at": "…" } }
}

Verify signatures

Read the raw request body (unparsed UTF-8). Parse Toolbench-Signature as t=<unix>,v1=<hex>. Compute HMAC-SHA256 of ${t}.${rawBody} using the full whsec_… signing secret from POST /webhooks (prefix included). Compare v1 in constant time and reject timestamps older than five minutes.

Node, Python, n8n, and Zapier patterns: Verify Toolbench webhook signatures.