APICRM
CRM webhooks and the merchant API
Keep your own systems in step with signed change events, and read or write CRM records with scoped API keys.
Add up to 20 HTTPS endpoints in Settings → CRM → Webhooks. Events include contact.created, contact.updated, stage.changed, task.completed and lead.created. Each carries ids and changed field names only, never personal data.
- Every delivery is signed with HMAC-SHA256 in
X-ElaraOne-Signature, using a secret shown once per endpoint. - Failed deliveries retry with backoff, up to eight attempts. A
410 Gonestops them at once. - A delivery log for each endpoint, with Send again.
- Merchant API keys carry only the abilities you give them, such as
crm:readormanage_orders. Usefilter[updated_since]to sync incrementally.
$valid = hash_equals(hash_hmac('sha256', $t.'.'.$rawBody, $secret), $v1)
&& abs(time() - $t) <= 300;
Follow every update with the RSS feed.