The signature can be found in the X-ICAAL-Signature header. This signature is a sha1 hash from the body of the webhook signed with your webhook secret key. If they don't match you shouldn't accept the request.
Here's an example of how you can verify incoming webhooks:
$webhook_secret='WEBHOOK_SECRET';$raw_post_data=file_get_contents('php://input');$header_signature=$headers['X-ICAAL-Signature'];$expected_signature=hash_hmac('sha1',$raw_post_data,$webhook_secret);if(!hash_equals($header_signature,$expected_signature)){ // Signature not verifiedexit;}
Failed Webhooks
If the webhook fails to receive a 2xx response code it will attempt to retry after the following intervals:
60 seconds
5 minutes
15 minutes
30 minutes
1 hour
Webhook Types
Lead Created
When a lead is created it will trigger this webhook. The data sent will depend on the type of lead. There are some examples below