Webhooks

DialDozer workflows can emit outbound events such as lead.created. Webhook delivery is asynchronous; your receiver must be idempotent and tolerant of retries.

Receiver checklist

1. Accept HTTPS POST requests.
2. Authenticate delivery using the configured webhook secret or allowlist policy.
3. Parse JSON only after enforcing a request-size limit.
4. Record an event or operation identifier before doing work.
5. Return a fast 2xx; process slow work asynchronously.
6. Log metadata, not secrets or unnecessary PII.

Example event

{
  "event": "lead.created",
  "data": {
    "lead_id": 42,
    "campaign": "OUTBOUND",
    "source": "website",
    "phone": "5551234567",
    "first_name": "Alice",
    "last_name": "Johnson"
  }
}

Treat the payload schema as additive: ignore unknown fields so new metadata does not break delivery.