MEGA Public CRM Lead Webhooks

asyncapi: 3.0.0
info:
  title: MEGA Public CRM Lead Webhooks
  version: 1.0.0
  description: >-
    Outbound webhook event surface for the MEGA public CRM Lead API. MEGA POSTs a
    signed `lead.created` event to a subscriber-registered public HTTPS endpoint
    whenever a genuine new lead is created. Deliveries are HMAC-SHA256 signed
    (X-Mega-Signature over `${timestamp}.${rawBody}`), at-least-once, and retried.
    Generated by the API Evangelist enrichment pipeline from the provider's
    published webhook documentation and OpenAPI payload schema.
  x-provenance:
    generated: '2026-07-21'
    method: generated
    source: https://docs.gomega.ai/webhooks
    derived_from: openapi/z-league-crm-lead-openapi.json
defaultContentType: application/json
servers:
  subscriber:
    host: api.your-company.com
    protocol: https
    description: Your public HTTPS endpoint registered via POST /api/agents/crm/lead-webhooks (SSRF-validated).
channels:
  leadCreated:
    address: '{subscriberWebhookUrl}'
    description: The subscriber-registered URL that receives lead.created deliveries.
    parameters:
      subscriberWebhookUrl:
        description: The public HTTPS URL you registered.
    messages:
      leadCreated:
        $ref: '#/components/messages/LeadCreated'
operations:
  receiveLeadCreated:
    action: receive
    channel:
      $ref: '#/channels/leadCreated'
    summary: Receive a lead.created event.
    messages:
    - $ref: '#/channels/leadCreated/messages/leadCreated'
components:
  messages:
    LeadCreated:
      name: lead.created
      title: Lead created
      contentType: application/json
      headers:
        type: object
        properties:
          X-Mega-Signature:
            type: string
            description: 'sha256=<hex> — HMAC-SHA256 over `${X-Mega-Timestamp}.${rawBody}` using the webhook secret.'
          X-Mega-Timestamp:
            type: string
            description: Unix seconds; folded into the signature (replay guard, ~5 min tolerance).
          X-Mega-Delivery:
            type: string
            format: uuid
            description: Delivery UUID; de-duplicate at-least-once retries on it.
      payload:
        $ref: '#/components/schemas/LeadCreatedWebhookPayload'
  schemas:
    LeadCreatedWebhookPayload:
      type: object
      required: [event, delivered_at, lead]
      properties:
        event:
          type: string
          enum: [lead.created]
        delivered_at:
          type: string
          format: date-time
        lead:
          type: object
          required: [id, source_platform, source_type, custom_fields, created_at, updated_at]
          properties:
            id: {type: string}
            contact_name: {type: [string, 'null']}
            contact_phone: {type: [string, 'null']}
            contact_email: {type: [string, 'null']}
            source_platform: {type: string}
            source_type: {type: string}
            lead_line: {type: [string, 'null']}
            current_stage:
              type: [object, 'null']
              properties:
                slug: {type: string}
                name: {type: string}
            custom_fields:
              type: object
              additionalProperties: {type: [string, number, boolean, 'null']}
            created_at: {type: string, format: date-time}
            updated_at: {type: string, format: date-time}