Start an automation when another app sends data (webhook)
Every automation with this trigger has its own link. Your website or any tool sends data to it, and the automation finds the matching record or creates one, fills in its fields, then carries on with its steps.
Once you create it, the automation gets its own address.
2
Under Your unique address, press Copy and paste the address into the other app.
3
Optional: under Which records?, choose where the data is kept, such as Leads.
Without a unit, the run works on the data alone.
4
Press Listen for a test request, then send a test request from the app.
The first request within 10 minutes is saved as a sample, and no run starts. The sample’s values show so you can choose from them.
5
For each value of the request, pick the field it fills, or Don’t keep.
6
Under Then, on …, choose Find it in …, or create it and the field in Find it by…, or Always add a new one to ….
Such as the mobile number. A record that already exists is updated, not doubled.
7
Add the steps and turn on the automation.
How are records chosen?
Setting
Result
No unit
A run without a record
A unit, without matching
A new record for every request
A unit with matching, and a record is found
The existing record is updated, with no duplicate
A unit with matching, and nothing is found
A new record
Matching compares mobile numbers by digits only, email ignoring upper and lower case, and text after normalizing it.
Using the data
Every value from the request is available as a {{webhook.path}} variable, such as {{webhook.customer.phone}}. Conditions can read every value too.
Security and duplicates
You can press Add a signing secret; the secret shows only once. After that, unsigned requests are refused. You can drop the signature requirement later with Stop checking.
A duplicate request doesn’t start a second run: the same idempotency key within 24 hours, or the same content within 10 minutes.
If the automation is paused, requests are refused, except in listening mode.
For developers
The request is a JSON object up to 64 KB. Signature: X-Corteksa-Timestamp in Unix seconds (±5 minutes), and X-Corteksa-Signature: v1=<HMAC-SHA256> over “timestamp.body”. The idempotency key goes in Idempotency-Key.
If something goes wrong
What you see
Why
What to do
The other app gets a refusal because of the signature
The secret is wrong, or the time is more than 5 minutes off.
Press Make new and give the new secret to the developer.
