Webhooks, Zapier and Make

​

Events

​

Connect Zapier

1. In Zapier, create a Zap and choose Webhooks by Zapier as the trigger, with the Catch Hook event.
2. Copy the webhook URL Zapier shows you (it starts with https://hooks.zapier.com/hooks/catch/).
3. In Growth Link, open Settings → Integrations & API, choose Add webhook, paste the URL and pick your events.
4. Choose Send test so Zapier receives a sample request, then continue setting up your Zap.

​

Connect Make

1. In Make, add the Webhooks module Custom webhook as the first module of a scenario and create a webhook.
2. Copy its address (for example https://hook.us1.make.com/…).
3. In Growth Link, add it as a webhook and choose Send test. Make uses the test request to learn the data structure.

​

Payload

{
  "id": "evt_6f1c2b9a0d4e8f7a6b5c4d3e",
  "type": "invitation.accepted",
  "api_version": "2026-10-17",
  "created_at": "2026-10-17T14:03:12.481Z",
  "occurred_at": "2026-10-17T14:03:12.402Z",
  "workspace_id": "c0a8012e-5b7d-4b0e-9f53-8f3c2a1d9e77",
  "data": {
    "person": {
      "id": "8d2f4a61-0c3b-4e5f-9a7d-1b2c3d4e5f60",
      "name": "Person Name",
      "linkedin_url": "https://www.linkedin.com/in/example/"
    },
    "campaign": {
      "id": "5e6f7a8b-9c0d-4e1f-8a2b-3c4d5e6f7a8b",
      "name": "Campaign name"
    }
  }
}

• id is unique per event and stays the same on every retry. Use it to ignore duplicates.
• occurred_at is when it happened; created_at is when Growth Link recorded the event.
• person is null for campaign.finished. campaign is null when the person is in no campaign. name and linkedin_url can be null when they are not known.
• Message text is never included, and no email addresses or phone numbers are sent.
• Send test sends "type": "webhook.test" with "data": { "person": null, "campaign": null, "test": true }.

​

Verify signatures

import crypto from 'node:crypto';
import express from 'express';

const secret = process.env.GROWTH_LINK_WEBHOOK_SECRET; // whsec_...
const app = express();

app.post('/growth-link', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('Entryway-Signature') || '';
  const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')));
  const timestamp = Number(parts.t);
  const body = req.body.toString('utf8'); // the raw body, before JSON parsing

  // Reject old requests (5 minutes) to limit replays.
  if (!timestamp || Math.abs(Date.now() / 1000 - timestamp) > 300) return res.sendStatus(400);

  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${body}`)
    .digest('hex');
  const given = Buffer.from(parts.v1 || '', 'utf8');
  if (given.length !== expected.length || !crypto.timingSafeEqual(given, Buffer.from(expected))) {
    return res.sendStatus(400);
  }

  const event = JSON.parse(body);
  // Deduplicate on event.id, then handle event.type.
  res.sendStatus(200); // answer quickly; do slow work afterwards
});

app.listen(3000);

​

Deliveries and retries

• Answer with any 2xx status within 10 seconds. Anything else, a timeout or a redirect counts as a failure. Redirects are never followed.
• Failed deliveries are retried up to 8 attempts in total, after about 1 minute, 5 minutes, 30 minutes, 2 hours, 5 hours, 8 hours and 8 hours (about 24 hours altogether).
• Delivery is at least once and not strictly in order: use id to drop duplicates and occurred_at to order events.
• Deliveries are sent by a background job that runs every minute and sends a limited number per run, so a large campaign launch can take a while to arrive in full.
• Deliveries shows the last 50 attempts for a webhook: the event, status, HTTP status code and the first 200 characters of the response. Nothing else from your response is stored. Delivery history is kept for 30 days.
• If every delivery fails for more than 24 hours (and at least 8 attempts in a row), the webhook is turned off and its queued events are cancelled. A 410 Gone response (for example, from a deleted Zap) turns it off immediately. Fix the receiver, choose Send test, then Turn on. Events from while it was off are not resent.

​

URL rules

• start with https:// and use the standard port (443);
• use a public domain name, not an IP address, localhost, or an internal name such as .local or .internal;
• not contain a user name or password.

​

Connecting AI tools