Act Webhooks

generated: '2026-08-13'
method: searched
source: >-
  https://apimta.act.com/act.web.api/ActHooks/Index (Act! WebHooks —
  Notifications) and the Webhooks operations in
  openapi/act-webhooks-api-openapi.yml.
type: Webhooks
asyncapi_published: false
asyncapi_note: >-
  Act! publishes no AsyncAPI document. Probed /asyncapi.yaml, /asyncapi.json and
  the Swiftpage GitHub organization — nothing. The event surface is documented
  in prose plus a REST registration API, so this file is the webhook catalog,
  not a spec.
description: >-
  Act! Web API ships a first-class webhook registration API: a client POSTs a
  webhook describing an entity to monitor, a trigger event, an optional OData
  query to shape the payload, a callback URL and a symmetric callback token.
  Notably, delivery is POLLED, not pushed at the moment of change — the Act!
  Webhook Notifications service polls on an interval (default 900 seconds) and
  then fires callbacks. An integrator expecting real-time semantics from the
  word "webhook" will be surprised: worst-case latency is the polling interval,
  not milliseconds.

availability:
  self_hosted: true
  cloud: false
  cloud_note: >-
    "This is not available in the cloud as of now, but coming soon." Webhooks
    are configured by the Act! installer, which creates or connects to a webhook
    registration database — so today the event surface belongs to self-hosted
    Act! Premium for Web deployments, not Act! Premium Cloud.
  source: https://apimta.act.com/act.web.api/ActHooks/Index

registration:
  endpoint: POST /api/webhooks
  operationId: Webhooks_Post_EE3CCFA8
  spec: openapi/act-webhooks-api-openapi.yml
  request_fields:
    monitor: The entity monitored for notifications.
    triggerEvent: The event that fires the notification.
    queryOption: >-
      Any valid OData query, used to target/filter the webhook and to request
      additional properties in the notification body. Optional. If null or
      blank the notification carries only the default properties. The provider
      warns that repeating a default property inside queryOption can stop the
      webhook firing correctly.
    callbackUrl: The endpoint the notification is POSTed to.
    callbackToken: A symmetric key added to the Authorization header of the callback.
    description: Free-text description of the webhook.

management_operations:
  - operationId: Webhooks_Get_3F017BC6
    method: GET
    path: /api/webhooks
    summary: List registered webhooks (OData query supported).
  - operationId: Webhooks_Get_8857FC56
    method: GET
    path: /api/webhooks/{id}
  - operationId: Webhooks_Put_20B03A3C
    method: PUT
    path: /api/webhooks/{id}
  - operationId: Webhooks_Patch_B8C243E8
    method: PATCH
    path: /api/webhooks/{id}
  - operationId: Webhooks_Delete_649F8293
    method: DELETE
    path: /api/webhooks/{id}
  - operationId: Webhooks_Suspend_A12B132D
    method: PUT
    path: /api/webhooks/{id}/suspend
    summary: Suspend a webhook.
  - operationId: Webhooks_Continue_511537A0
    method: PUT
    path: /api/webhooks/{id}/continue
    summary: Resume a suspended webhook.
  - operationId: Webhooks_PutTokenReset_C1A718D3
    method: PUT
    path: /api/webhooks/reset-token
    summary: Rotate the webhook callback token.

monitors:
  - Activities
  - Companies
  - Contacts
  - Fields
  - Groups
  - History
  - Opportunities
  - Products

trigger_events:
  - Created
  - Updated
  - Alarms

events:
  - name: Activities.Created
    monitor: Activities
    triggerEvent: Created
  - name: Activities.Updated
    monitor: Activities
    triggerEvent: Updated
  - name: Activities.Alarms
    monitor: Activities
    triggerEvent: Alarms
    note: >-
      Alarms behave differently from the other events — they are pulled into a
      queue on the polling cycle but are not broadcast until the alarm actually
      sounds. Default payload properties for Alarms are id, startTime and
      leadMinutes.
  - name: Companies.Created
    monitor: Companies
    triggerEvent: Created
  - name: Companies.Updated
    monitor: Companies
    triggerEvent: Updated
  - name: Contacts.Created
    monitor: Contacts
    triggerEvent: Created
  - name: Contacts.Updated
    monitor: Contacts
    triggerEvent: Updated
  - name: Fields.Created
    monitor: Fields
    triggerEvent: Created
    note: >-
      Metadata is cached, so Fields webhooks do not send notifications when a
      field is created or updated OUTSIDE the API.
  - name: Fields.Updated
    monitor: Fields
    triggerEvent: Updated
    note: Same metadata-cache caveat as Fields.Created.
  - name: Groups.Created
    monitor: Groups
    triggerEvent: Created
  - name: Groups.Updated
    monitor: Groups
    triggerEvent: Updated
  - name: History.Created
    monitor: History
    triggerEvent: Created
  - name: History.Updated
    monitor: History
    triggerEvent: Updated
  - name: Opportunities.Created
    monitor: Opportunities
    triggerEvent: Created
  - name: Opportunities.Updated
    monitor: Opportunities
    triggerEvent: Updated
  - name: Products.Created
    monitor: Products
    triggerEvent: Created
  - name: Products.Updated
    monitor: Products
    triggerEvent: Updated

payload:
  default_properties: [id, created, edited]
  alarm_default_properties: [id, startTime, leadMinutes]
  shaping: queryOption (OData $select/$expand) adds properties to the notification body.

delivery:
  model: polled-then-pushed
  polling_interval_seconds: 900
  polling_interval_setting: PollingIntervalSeconds
  retry_interval_seconds: 120
  retry_interval_setting: PollingRetryIntervalSeconds
  retry_attempts: 3
  retry_attempts_setting: RetryAttempts
  on_exhaustion: The webhook is suspended (resume with PUT /api/webhooks/{id}/continue).
  configuration_service: Act.Webhook.Notifications
  note: >-
    These are service-configuration settings on the Act! installation, so an
    on-premises administrator can change them; the values above are the
    documented defaults.

security:
  callback_auth: >-
    The callbackToken supplied at registration is sent back in the
    Authorization header of each callback — a shared bearer secret, not a
    signature.
  signature: false
  signature_note: >-
    There is no HMAC payload signature and no timestamp/replay defence. A
    receiver can only compare the Authorization header to the token it
    registered, which means the secret travels on every delivery.
  tls: >-
    The provider explicitly documents registering an http:// callbackUrl when
    the receiver has no valid certificate, and registering the Act! Web API over
    http when IT is not certificated — so plaintext delivery of the shared token
    is a documented path.

gaps:
  - No AsyncAPI document.
  - No HMAC signature on deliveries; the shared token is replayed on every callback.
  - Plaintext (http) callback registration is documented as supported.
  - Not available on Act! Premium Cloud ("coming soon").
  - Minimum 15-minute notification latency by default.