Outbound webhooks

Tell another system the instant something happens in the CRM. You register a URL, tick the events you care about, and SellioCRM sends a POST with signed JSON whenever one of them occurs. It is how you integrate with automation tools, with your own back end or with the company's ERP.

Integrating by polling is slow and expensive: somebody has to ask every minute whether anything changed. A webhook works the other way around: the CRM tells you. When a record is created, when an approval is decided or when someone replies to a cadence, the system sends a request to the address you registered, carrying the event's data.

How to register one

1. Open Settings and go to the Channels and communication group.
2. Click Webhooks.
3. Under Target URL, enter the address that will receive the calls, starting with https.
4. Under Events, tick the ones you care about. record.created and record.updated come ticked.
5. Click Create webhook.
6. Copy the secret shown in the Webhook secret card. It is displayed only once.

Available events

• Records: record.created and record.updated, fired when any record of your objects is created or updated.
• Cadences and flows: flow.enrolled, flow.message_sent, flow.replied, flow.step_completed and flow.completed.
• Approvals: approval.requested, approval.approved and approval.rejected.

How to verify the call came from SellioCRM

Every call carries two headers besides the content type: x-sellio-event, with the event name, and x-sellio-signature, in the form sha256 followed by the authentication code computed over the exact request body using your secret. On your server, recompute that code from the body you received and compare. If it does not match, discard it: the call did not come from your CRM.

POST https://your-system.com/webhook
x-sellio-event: record.created
x-sellio-signature: sha256=<code computed with your secret>
content-type: application/json

{
  "event": "record.created",
  "tenantId": "...",
  "objectApiName": "opportunity",
  "recordId": "...",
  "data": { "name": "Andrade Metalworks", "amount": 48000 },
  "timestamp": "2026-03-12T15:42:10.000Z"
}

Recent deliveries

Below the webhook list, the Recent deliveries table shows the latest send attempts with the time, the event and the outcome: a green badge with the response code when it worked, a red badge with the error when it did not. That is where you spot an address that is down or a server returning errors.

Limits and behavior

• The call goes out immediately, with a maximum wait of four seconds, and it never holds up the person who saved the record.
• There is no automatic retry. If your server is down, the event shows up as a failure in the deliveries table and is not sent again. Design your side to tolerate that.
• Only http and https addresses pointing at the public internet are accepted. Internal addresses, local network addresses and cloud metadata services are refused for security reasons.
• The Active and Paused checkbox next to each webhook stops the deliveries without erasing the configuration.
• The secret cannot be shown again. If you lost it, delete the webhook and create another.

Who can do this

Creating, pausing and deleting webhooks requires permission to administer settings, because the operation sends your record data outside the CRM. The delivery list is restricted to your own organization.

Common questions

• I get the event but the body looks incomplete: each event carries its own set of fields. Record events bring the object, the record identifier and the data; flow events bring the flow, the enrollment and the record; approval events bring the request, the subject and the status.
• Can I receive deletion events? The list of available events is the one shown on screen.
• The signature never matches: compute the code over the raw body you received, without reserializing the JSON, because any change in whitespace changes the result.

Open this article inside the system →