Documentation

Webhooks

Orbit pushes CRM events to any HTTPS endpoint you own. Configure endpoints in the app under Lead Sync → Outbound webhooks: pick the events you want, and Orbit signs and delivers each one, keeping a delivery log with the response status and body. See also the API reference.

Events available today

Orbit emits 44 events across 7 areas of the product. Events are emitted at the database layer, so they fire regardless of whether the change came from the UI, the API, an import, an automation or an AI action.

Delivery format

Every delivery is a POST with a JSON body and these headers:

POST https://your-endpoint.example.com/orbit
Content-Type: application/json
X-Orbit-Event: contact.created
X-Orbit-Signature: sha256=<hex digest>

The body always has the same envelope:

{
  "event": "contact.created",
  "tenant_id": "b3f0c9e2-...",
  "timestamp": 1765412345678,
  "data": {
    "id": "0f0b1f2c-...",
    "contact_id": "0f0b1f2c-...",
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "company": "Analytical Engines",
    "title": "Head of Engineering",
    "lead_source": "Website form",
    "deal_value": 12000,
    "tags": ["inbound", "enterprise"],
    "status": "new"
  }
}

data carries the object the event is about. Treat it as additive: new fields may appear over time, so parse defensively rather than asserting an exact shape.

Verifying the signature

Each endpoint has its own secret, shown when you create it. Orbit computes an HMAC-SHA256 of the exact raw request body using that secret and sends it as X-Orbit-Signature. Compute the same digest over the raw body and compare in constant time — always before parsing.

import { createHmac, timingSafeEqual } from "crypto";

export function verifyOrbit(rawBody: string, header: string, secret: string) {
  const expected = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(header ?? "");
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Responses, retries and logs

• Return a 2xx as quickly as you can and process asynchronously. Anything non-2xx is recorded as a failure.
• Orbit stores every attempt — event type, response status, and the first 500 characters of the response body — visible in the delivery log next to the endpoint.
• Each endpoint tracks its last delivery time, last status and consecutive failure count so you can spot a broken receiver quickly.
• Deliveries may arrive more than once during transient failures. Make your handler idempotent by keying on data.id plus event.
• Endpoints can be disabled without deleting them, which pauses delivery while keeping the history.

Coverage

Every event in the table above is emitted today, including invoice and contract lifecycle, event registrations, quest submissions and reviews, and meeting and transcript events. Events are raised at the database layer, so they fire regardless of whether the change came from the app, the API, a CSV import, an automation or an AI action. If you need an event that is not listed, tell us and we will add it.