What authentication do inbound webhooks use?

Bearer token with whk_ prefix, copied once when you create the endpoint in Setup → Webhooks → Inbound. Include it in the Authorization header on POST requests to /api/webhooks/inbound/{id}.

Do outbound webhooks include bulk import events?

Only when you enable the per-rule toggle. By default, bulk import events are excluded so large migrations do not flood subscribers.

How long are event logs kept?

14 days. Filter by direction, date, status, and webhook rule to inspect payloads, HTTP responses, and links to affected records.

Can I test without creating real records?

Yes. Outbound rules support an editable test payload that sends webhook.test. Use Event logs to confirm the subscriber received and authenticated the request.

Push CRM events out and pull data in

Configure outbound webhooks that POST JSON when records are created, updated, or deleted — and inbound endpoints that map external JSON into CRM fields. Event logs help you verify deliveries while integrations go live.

14d

Event log retention

Debug deliveries while testing

whk_

Inbound Bearer

Token shown once at create

2-way

Sync pattern

Push CRM changes; pull external payloads

Events in both directions

Outbound POSTs on change; inbound JSON to records.

Your CRM should talk to billing, marketing automation, and custom services without a nightly CSV export. Outbound webhooks fire on record changes; inbound webhooks accept authenticated POSTs that create, update, or upsert records.

Setup → Webhooks covers both directions, authentication options, and a 14-day event log. Test payloads let you confirm subscriber configuration before touching live traffic.

Outbound on record changes
Point rules at subscriber URLs. Choose objects, events, and auth — header, basic, or HMAC signature.
Inbound JSON endpoints
External systems POST to /api/webhooks/inbound/{id} with Bearer whk_ token. Map JSON paths to CRM fields.
Event logs for debugging
Filter by direction, date, status, and rule. Inspect payload, mapped fields, HTTP response, and record link.

Outbound

Outbound: CRM events to your stack

OSTRATA POSTs JSON when selected objects change — your automation platform or service receives structured payloads.

Per-rule toggle for bulk import events (off by default)
Editable test payload sends webhook.test without live records
Match subscriber auth — header, basic, or HMAC

Inbound

Inbound: external data into records

Create endpoints that map JSON fields to object columns with create, update, or upsert behavior.

Bearer whk_ token shown once at endpoint creation
Assign a permission profile to cap what the endpoint can write
Map nested JSON paths to flat CRM fields

Verify

Verify before production traffic

Event logs and test payloads reduce guesswork when wiring n8n, Zapier, or custom services.

Click Test on outbound rules and confirm delivery in logs
Run inbound workflows and verify mapped fields plus record link
Logs retained 14 days for troubleshooting

API

Works beside the REST API

Webhooks for event-driven flows; API keys for polling and batch jobs.

Outbound pushes changes as they happen
Inbound accepts pushes from external systems
Scoped API keys still govern programmatic read/write

Scope

Permission-aware writes

Inbound endpoints inherit a permission profile so automation cannot exceed intended scope.

Cap create/update to specific objects and fields
Same profile model as API keys and member access
Audit deliveries in Event logs per rule

Questions

Short answers before you request access.

What authentication do inbound webhooks use?: Bearer token with whk_ prefix, copied once when you create the endpoint in Setup → Webhooks → Inbound. Include it in the Authorization header on POST requests to /api/webhooks/inbound/{id}.
Do outbound webhooks include bulk import events?: Only when you enable the per-rule toggle. By default, bulk import events are excluded so large migrations do not flood subscribers.
How long are event logs kept?: 14 days. Filter by direction, date, status, and webhook rule to inspect payloads, HTTP responses, and links to affected records.
Can I test without creating real records?: Yes. Outbound rules support an editable test payload that sends webhook.test. Use Event logs to confirm the subscriber received and authenticated the request.