Z League Lead Webhooks

generated: '2026-07-21'
method: searched
source: https://docs.gomega.ai/webhooks
type: Webhooks
api: MEGA Public CRM Lead API
transport: outbound-http-post
management:
  register: POST /api/agents/crm/lead-webhooks
  list: GET /api/agents/crm/lead-webhooks
  update: PATCH /api/agents/crm/lead-webhooks/{id}
  delete: DELETE /api/agents/crm/lead-webhooks/{id}
  scope: public_api:webhooks:manage
events:
- name: lead.created
  when: A genuine new lead is inserted (not on merges into an existing lead; bulk-uploaded leads do not fire).
  payload_schema: LeadCreatedWebhookPayload (see openapi/z-league-crm-lead-openapi.json)
signature:
  header: X-Mega-Signature
  algorithm: HMAC-SHA256
  signed_material: '`${X-Mega-Timestamp}.${rawRequestBody}`'
  format: sha256=<hex>
  secret: Returned exactly once at webhook creation (and again only on rotate_secret); prefix mega_whsec_
  verification: Compute over the RAW request bytes; constant-time compare.
headers:
- {name: X-Mega-Signature, meaning: HMAC-SHA256 signature}
- {name: X-Mega-Timestamp, meaning: Unix seconds, folded into the signature}
- {name: X-Mega-Delivery, meaning: Delivery UUID; de-duplicate at-least-once retries on it}
delivery_semantics:
  ack: Respond 2xx; any non-2xx or timeout is retried.
  timeout_seconds: {default: 10, min: 1, max: 60}
  retry_attempts: {default: 5, min: 0, max: 10, total_attempts: retry_attempts + 1}
  backoff: Exponential, capped at 30s.
  guarantee: at-least-once
  terminal: Redirects are not followed; SSRF-blocked URLs are not retried.
replay_protection: Reject deliveries whose X-Mega-Timestamp is outside a ~5 minute tolerance window.