Sign requests

Partners prove identity with a signature. There is no API key and no JWT on this path.

Endpoint

POST /api/v1/webhooks/partners/{appId}/events
Content-Type: application/json
X-Partner-Signature: sha256=<hex>
X-Correlation-Id: <optional>

{appId} is the inbound app id from Portal Webhooks → Apps.

Payload

{
  "eventType": "contact.lead",
  "externalId": "lead-1001",
  "data": "{\"email\":\"ada@example.com\",\"firstName\":\"Ada\"}"
}

• eventType must match a catalog workflow webhookBind (contact-lead uses contact.lead).
• externalId is unique per appId. Resubmits of the same id return 200 Duplicate and start zero extra runs.
• data is a JSON string (or object, depending on the partner). Lead PII stays on the event row, not in Temporal input.

Signature

HMAC-SHA256 over the raw request body, hex-encoded. Do not canonicalize or re-serialize JSON before hashing.

BODY='{"eventType":"contact.lead","externalId":"lead-1001","data":"{\"email\":\"ada@example.com\"}"}'
SIG=$(echo -n "$BODY" | openssl dgst -sha256 -hmac "$HMAC_SECRET" | awk '{print $2}')

curl -sS -D - \
  -X POST "https://connect.intronsoft.com/api/v1/webhooks/partners/acme/events" \
  -H "Content-Type: application/json" \
  -H "X-Partner-Signature: sha256=$SIG" \
  -d "$BODY"

Responses

The workflow id is the accept correlationId. After ten failed starts the scheduler skips the row. Operators Retry start from Events.

Try it

Interactive reference: APIs → Experience → Contact lead inbound.

If this fails

Next: Inbound events · Contact leads