Webhooks integration · Automation
Your endpoint. Signed JSON events.
SuperBot webhooks POST a JSON body to your HTTPS endpoint whenever a selected event fires: new lead captured, form submitted, new conversation started, or conversation escalated to a human. Add a signing secret and each request carries an X-SuperBot-Signature header — an HMAC-SHA256 of the raw body — so your server can confirm it came from SuperBot.
- Endpoint URL (+ optional signing secret)
- SuperBot → your HTTPS endpoint (signed JSON)
- Free, Starter & Pro
How the Webhooks integration works
Every request has the same shape: { event, data, occurredAt }. data holds the visitor's name, email, phone, company, message, and source when known, plus event-specific fields such as conversationId, siteId, or form_name. Requests use the User-Agent SuperBot-Integrations/1.0 and time out after 10 seconds.
Network errors, 429s, and 5xx responses are retried up to three attempts with a short backoff. A 4xx is not retried, because the request itself needs fixing. The connection card shows the time of the last delivery and the last error.
- New lead captured
- Form submitted
- New conversation started
- Conversation escalated to a human
Highlighted: the events most teams keep for this connector. You choose per connection.
What gets sent
| From SuperBot | In Webhooks |
|---|---|
| Content-Type | application/json |
| X-SuperBot-Signature | Hex HMAC-SHA256 of the raw body (when a secret is set) |
| event | One of the four event names |
| data | Visitor details and event fields |
| occurredAt | ISO 8601 timestamp |
To verify, compute HMAC-SHA256 over the exact raw request body with your secret and compare the hex digest to the header in constant time, before parsing the JSON.
Connect Webhooks to SuperBot
- Deploy an HTTPS endpoint that accepts POST requests with a JSON body and returns a 2xx quickly.
- In SuperBot, open Dashboard → Integrations, find Webhooks, and select Connect.
- Paste the address into “Endpoint URL”. It must be a public address; localhost and private network ranges are refused.
- Optionally set a “Signing secret” to receive the X-SuperBot-Signature header.
- Under “Send these events”, keep only the events you want this connection to receive. All four are ticked by default: new lead captured, form submitted, new conversation started, and conversation escalated to a human.
- Select “Connect & verify”, then “Send test” to deliver a sample lead.captured-shaped payload to your endpoint.
Don't have a workspace yet? Sign up free — no card needed — then open Dashboard → Integrations.
Permissions and privacy
- Your endpoint receives visitor contact details and the latest message when known. Serve it over HTTPS and store what you keep responsibly.
- Redirects are not followed, and URLs that resolve to private or internal addresses are refused, so a webhook cannot be used to reach your internal network.
- The signing secret is encrypted before storage and never returned to the browser.
- Disable pauses delivery; Disconnect removes the endpoint and secret.
What teams use Webhooks with SuperBot for
- Your own data warehouse
Stream conversation and lead events into your database or analytics pipeline.
- Internal tools and paging
Trigger your own on-call or ticketing flow when a conversation is escalated to a human.
- Automation platforms
Point it at Make, n8n, or Pipedream the same way you would a Zapier Catch Hook.
FAQ
Webhooks integration questions, answered.
Ready to try it? Start free or compare plans. Every integration is on every plan.
How do I verify a SuperBot webhook signature?
Set a signing secret when you connect. Compute HMAC-SHA256 of the raw request body with that secret and compare the hex digest to the X-SuperBot-Signature header.
Which events can I receive?
lead.captured, form.submitted, conversation.created, and conversation.escalated. You pick which ones each endpoint gets.
Does SuperBot retry failed webhooks?
Yes, for network errors, 429s, and 5xx responses — up to three attempts with backoff. 4xx responses are not retried.
Can I send webhooks to localhost for testing?
No. Private and local addresses are refused. Use a public tunnel or a request-inspection service while developing.
Are webhooks available on the free plan?
Yes. Webhooks, like every SuperBot integration, work on Free, Starter, and Pro.