Webhooks integration
Send signed warm lead signals into your team's workflow.
Save one public HTTPS destination for a website, copy its signing secret and test the connection. Choose Send alert beside a warm visitor to send a signed JSON payload. Your receiver verifies the signature before processing the event.
What you get
Hand off recorded intent
Alerts include the visitor reference, recorded signal, first source, last page, visit/pageview counts and last-seen time. They are loaded again from the authorized website report when you send, rather than trusting a browser-supplied visitor summary.
Control contact sharing
Known name, email and company fields are omitted by default. An owner or admin can enable contact sharing for the saved destination. Page paths and recorded intent text are still included, so choose a destination appropriate for the information your website records.
Test before sending a visitor
The test sends a connection message with no visitor information. The destination URL is encrypted in Vault. One attempt is allowed per 30 seconds, and the same visitor can be sent once every 15 minutes. There are no automatic retries.
Connect Webhooks
Read the alert setup guidePrepare your HTTPS receiver
Use a public HTTPS endpoint on port 443. The receiver should read the unmodified request body and verify the timestamp and HMAC signature. Redirects and private-network destinations are not supported.
Save and test the destination
Open Buyers → Who is buying → Almost buying → Slack / Webhook alerts. Select the destination type, paste the URL and choose whether to include known contact details. Save destination, then Test saved destination. HTTPS receivers receive a signing secret once after saving; resaving rotates it.
Choose the visitor and send
Review the website, dates and intent signal, then choose Send alert beside the relevant warm visitor. Wait at least 30 seconds after a test before sending. An accepted delivery means the receiver returned success, not that a teammate acted on the lead.
Delivery errors
A timeout can occur after a receiver accepts a message. Check the destination before retrying. HTTPS events carry an event ID for receiver-side deduplication. Removing a destination deletes its stored secret and stops new sends; messages already delivered remain in the receiving service.
Intent does not guarantee a sale. Almost buying describes observed website activity and does not identify an anonymous visitor or predict a guaranteed purchase. Read the alert setup and payload guide for sharing controls, delivery limits and signature verification.
Common questions
Are alerts automatic?
No. Owners and admins save a destination and explicitly choose Test or Send alert. Copy brief and CSV export remain available for a manual handoff. No background alert sender watches every visit.
What information can leave Attriboo?
A warm visitor's reference, source, recorded signal, page, counts and last-seen time. Known name, email and company fields are included only when contact sharing is enabled for the saved destination. A connection test contains no visitor information.
Why did the send button refuse another alert?
Attempts are limited to one every 30 seconds per website. A successfully sent visitor is held for 15 minutes to reduce duplicates. The visitor must still qualify for Almost buying in the selected dates when the server checks the report.
How do I verify a webhook?
Verify X-Attriboo-Signature against an HMAC-SHA256 of timestamp, a period and the exact request body, using the secret shown after save. Reject stale timestamps and deduplicate by event ID. The setup guide includes a server-side example.
Connect Webhooks and see what pays.
Explore the dashboard with sample data, or start free and connect your own site.
Start freeFree plan · No credit card required