Webhooks

Subscribe a URL to platform events and ABM.dev will POST a signed payload to it whenever the event fires. Useful for piping enrichment results into a CRM, kicking off downstream automations, or driving notifications without polling.

How delivery works

Subscribe — POST a URL + an event type. We return a one-time signing secret. Save it.
Receive — when the event fires we POST a JSON envelope to your URL with X-Webhook-Signature, X-Webhook-Event, and X-Webhook-Id headers.
Verify — recompute HMAC-SHA256 over the raw body using your secret and compare against the signature header.
Retry policy — non-2xx responses retry 3× with exponential backoff (2s / 4s / 8s). 10 consecutive failures auto-disables the subscription.

Don’t want to host an endpoint? Poll GET /v1/webhooks/events instead — same payloads, your timing.

Subscriptions

CRUD over your webhook subscriptions

Events

Pull events directly when running an HTTP receiver isn’t an option (Zapier polling triggers, ad-hoc backfills, recovery from a downtime window).

Verifying signatures

Always verify before trusting a payload — it’s how you tell an authentic ABM.dev delivery from a forged one.

HMAC-SHA256 signature verification

import crypto from "node:crypto";

export function verify(rawBody, signatureHeader, secret) {
  // signatureHeader looks like "sha256=abc123..."
  const [algo, theirs] = signatureHeader.split("=");
  if (algo !== "sha256") return false;

  const ours = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(theirs, "hex"),
    Buffer.from(ours, "hex"),
  );
}

See also: Zapier integration (uses these endpoints under the hood), Enrichment (the producer of enrichment.completed).

import crypto from "node:crypto"; export function verify(rawBody, signatureHeader, secret) { // signatureHeader looks like "sha256=abc123..." const [algo, theirs] = signatureHeader.split("="); if (algo !== "sha256") return false; const ours = crypto .createHmac("sha256", secret) .update(rawBody) .digest("hex"); return crypto.timingSafeEqual( Buffer.from(theirs, "hex"), Buffer.from(ours, "hex"), ); }