Webhooks

Outgoing webhooks are available on the Premium plan.

An endpoint URL must use https and point to a public internet address. Redirects are not followed, so give the final URL.

Events

Event	When
location.created	A location is added
location.updated	A location changes
location.deleted	A location is removed
lead.created	A lead or application arrives
lead.updated	A lead is approved, rejected or changed

Subscribe to a list of events, or to * for all of them.

Payload

{
  "event": "lead.created",
  "created_at": "2026-10-11T09:30:00Z",
  "data": { "...": "the lead or location" }
}

Headers

Header	Value
X-Stockist-Event	The event name
X-Stockist-Delivery	A unique delivery id
X-Stockist-Signature	sha256= followed by the hex HMAC-SHA256 of the body

Verifying the signature

Compute the HMAC-SHA256 of the raw request body with your endpoint secret and compare it with the header:

import crypto from 'node:crypto';

function verify(rawBody, header, secret) {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(expected), b = Buffer.from(header ?? '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Retries

Any response other than 2xx (including a redirect), or no response within 20 seconds, is retried with exponential backoff (1 minute, 2 minutes, 4 minutes and so on, up to 6 hours apart), for up to 8 attempts in total. Every attempt is listed under the endpoint’s deliveries.