Webhooks let your backend react to RevRoute events the moment they happen — instead of polling the API. RevRoute sends an HTTP POST to a URL you control with a signed JSON payload describing what changed.
Use webhooks to:
- Sync new leads and sales into your CRM or data warehouse
- Send Slack/Telegram notifications when a partner applies or a commission is created
- Trigger custom approval flows for payouts
- Mirror link activity in your own analytics
Webhooks are delivered with at-least-once semantics. Make your handler idempotent — RevRoute may retry the same event multiple times on transient failures.
How it works
Create a webhook
In your workspace go to Settings → Webhooks and click Create webhook. Provide a URL (must be https://), pick the events you want to receive and save. RevRoute generates a signing secret in the form whsec_....
Receive the event
When a subscribed event fires, RevRoute sends a POST request to your URL with a JSON body and the headers:
Content-Type: application/json
Revroute-Signature: <hex hmac-sha256>
User-Agent: RevRoute-Webhook/1.0Verify the signature
Compute HMAC-SHA256 over the raw request body using your webhook secret and compare it (in constant time) against the Revroute-Signature header. Reject requests that do not match. See Signature verification.
Respond quickly
Return a 2xx response within 10 seconds. Do any heavy processing in a background job — long handlers will be retried and may eventually disable the webhook.
Webhook scopes
Webhooks can be attached at three levels, depending on what you want to observe:
| Scope | Where to create | Events available |
|---|---|---|
| Workspace | /<workspace>/settings/webhooks | link.created, link.updated, link.deleted, lead.created, sale.created |
| Program | /<workspace>/program/settings/webhooks | partner.application_submitted, partner.enrolled, commission.created, bounty.created, bounty.updated, payout.confirmed |
| Link | Per-link settings on a short link | link.clicked |
See the full payload reference in Event types.
Delivery and retries
- RevRoute retries failed deliveries with exponential backoff for up to 24 hours.
- After 5, 10 and 15 consecutive failures you receive an email warning.
- After 20 consecutive failures the webhook is automatically disabled — fix the endpoint and re-enable it from the dashboard.
- A delivery is considered successful when your endpoint returns an HTTP status in the
2xxrange.
Endpoints behind self-signed TLS certificates or private networks are not supported. Your URL must be reachable from the public internet and present a valid certificate.
Event envelope
Every webhook payload follows the same shape:
{
"id": "evt_2T3jZ...",
"event": "lead.created",
"createdAt": "2026-05-15T12:34:56.789Z",
"data": { /* event-specific payload */ }
}id— unique event id (evt_*). Use it for deduplication.event— the trigger name (see Event types).createdAt— ISO-8601 timestamp of when the event was produced server-side.data— the resource payload for that event.