# Hootsuite CRM Webhooks API

**Canonical:** https://apis.io/apis/hootsuite/hootsuite-crm-webhooks-api/  
**Provider:** Hootsuite — https://apis.io/providers/hootsuite/  
**Base URL:** https://platform.hootsuite.com/v1  
**Documentation:** https://developer.hootsuite.com/docs/api-overview

Hootsuite CRM Webhooks API is one of 21 APIs that [Hootsuite](https://apis.io/providers/hootsuite/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an API reference, a getting-started guide, authentication docs, and rate-limit docs.

### Webhook authentication When receiving data from Inbox 2.0, we provide two authentication options. Both mechanisms are in place so that you can make sure the request originates from Inbox 2.0. #### Shared secret If you choose the shared secret authentication method, a secret will be generated for you. This secret allows you to calculate the signature to verify that the call originated from Inbox 2.0. With this mechanism, every single request from Inbox 2.0 contains the `X-Hootsuite-Signature` header. Here's an example of a request: ```shell curl -X POST https://my-webhook-url \ -H 'content-type : application/json' \ -H 'accept: application/json' \ -H 'X-Hootsuite-Signature: e6f93239a06e46ae9654fc9ad2fb4e1cc4eb213830a0d94e711570c047e43c57' \ -d '{ "version": 2, "contactProfile": { "id": "a7a20053-9c54-11eb-a89f-47717a44c639" }, "contactAttributes": [ {"attribute": "email", "value": "fj@example.com"} ] }' ``` The signature is generated using the `HMAC-SHA256` algorithm with the shared secret and the request body. Use your secret to calculate the signature and compare with the given signature. Both the secret key you received and the signature are encoded as hexadecimal strings. Make sure to convert the shared secret from its hexadecimal representation to its binary format before using it. Most languages come with libraries out of the box to verify this signature. For example, here's how it looks in JavaScript: ```javascript const crypto = require("crypto"); const secret = "..."; // do not share! const expectedSignature = request.headers["X-Hootsuite-Signature"]; const actualSignature = crypto .createHmac("sha256", Buffer.from(secret, "hex")) .update(request.body, "utf-8") .digest("hex"); if (actualSignature !== expectedSignature) { throw new createError.Unauthorized("X-Hootsuite-Signature wrong"); } console.log(JSON.parse(request.body).email); ``` #### OAuth If your endpoints support OAuth2, you can configure your client credentials, a Token URL, and, optionally, a Scope in Inbox 2.0. We use the OAuth2 Client Credentials flow to authenticate against your CRM. The Token URL is the endpoint where we can authenticate with these credentials and retrieve an access token. To do the actual lookup, write back, or notification requests, we use the token in the Authorization Header to authenticate.

## Machine-readable artifacts (19)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/hootsuite/refs/heads/main/openapi/hootsuite-crm-webhooks-api-openapi.yml
- **Documentation** — https://developer.hootsuite.com/docs/api-overview
- **APIReference** — https://apidocs.hootsuite.com/docs/api/index.html
- **GettingStarted** — https://developer.hootsuite.com/docs/getting-started-with-the-rest-api
- **Authentication** — https://developer.hootsuite.com/docs/api-authentication
- **OAuth 2.0** — https://developer.hootsuite.com/docs/enabling-oauth-20
- **Postman** — https://app.getpostman.com/run-collection/eeda0fcdf55ea26bd0ec
- **Webhooks** — https://raw.githubusercontent.com/api-evangelist/hootsuite/refs/heads/main/asyncapi/hootsuite-webhooks.yml
- **RateLimits** — https://raw.githubusercontent.com/api-evangelist/hootsuite/refs/heads/main/rate-limits/hootsuite-rate-limits.yml
- **ErrorCatalog** — https://raw.githubusercontent.com/api-evangelist/hootsuite/refs/heads/main/errors/hootsuite-problem-types.yml
- **DataModel** — https://raw.githubusercontent.com/api-evangelist/hootsuite/refs/heads/main/data-model/hootsuite-data-model.yml
- **Documentation** — https://developer.hootsuite.com/docs/analytics-overview
- **APIReference** — https://apidocs.hootsuite.com/docs/api/analytics/index.html
- **GettingStarted** — https://developer.hootsuite.com/docs/using-the-api
- **OAuthScopes** — https://raw.githubusercontent.com/api-evangelist/hootsuite/refs/heads/main/scopes/hootsuite-scopes.yml
- **Documentation** — https://developer.hootsuite.com/docs/inbox-overview
- **APIReference** — https://apidocs.hootsuite.com/docs/api/inbox/index.html
- **Documentation** — https://developer.hootsuite.com/docs/amplify-overview
- **APIReference** — https://amplify.hootsuite.com/api-docs

## Other Hootsuite APIs (12)

- [Hootsuite Developer Documentation MCP](https://apis.io/apis/hootsuite/mcp/)
- [Hootsuite Analytics API](https://apis.io/apis/hootsuite/hootsuite-analytics-api-api/)
- [Hootsuite Authentication API](https://apis.io/apis/hootsuite/hootsuite-authentication-api/)
- [Hootsuite Comments API](https://apis.io/apis/hootsuite/hootsuite-comments-api/)
- [Hootsuite CRM Rest API](https://apis.io/apis/hootsuite/hootsuite-crm-rest-api-api/)
- [Hootsuite Me API](https://apis.io/apis/hootsuite/hootsuite-me-api/)
- [Hootsuite Media API](https://apis.io/apis/hootsuite/hootsuite-media-api/)
- [Hootsuite Members API](https://apis.io/apis/hootsuite/hootsuite-members-api/)
- [Hootsuite Messages API](https://apis.io/apis/hootsuite/hootsuite-messages-api/)
- [Hootsuite Organizations API](https://apis.io/apis/hootsuite/hootsuite-organizations-api/)
- [Hootsuite Proactive Messaging Rest API](https://apis.io/apis/hootsuite/hootsuite-proactive-messaging-rest-api-api/)
- [Hootsuite Queue Rest API](https://apis.io/apis/hootsuite/hootsuite-queue-rest-api-api/)

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/hootsuite/hootsuite-crm-webhooks-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/hootsuite/.