1. Overview
The Lead Delivery Webhook pushes every qualified lead captured by AES to an external endpoint of the customer’s choosing, as it happens. It is the simplest way to mirror AES capture into a third-party system without granting access to the platform.
Delivery is push and at-least-once. The receiving endpoint is expected to be idempotent on event_id.
2. Configuration
Delivery is configured per environment and is disabled by default. It is enabled from the customer’s administration panel, where the destination URL and the signing secret are set.
| Setting | Description |
|---|---|
| Destination URL | HTTPS endpoint that receives the payload. |
| Signing secret | Shared secret used to compute the signature header. |
| Events | Which lifecycle events are delivered. |
| Status | Delivery is off until explicitly enabled. |
3. Payload
POST {your_endpoint}
Content-Type: application/json
X-AES-Event: lead.created
X-AES-Signature: sha256=<hmac_hex>
X-AES-Timestamp: 1787923271
{
"event": "lead.created",
"event_id": "evt_71ab30cd",
"lead_id": "AES-38-104772",
"occurred_at":"2026-08-27T14:02:11-06:00",
"contact": {
"name": "Maria Fernanda Rios",
"phone_e164": "+5218112345678",
"email": "mfrios@example.com"
},
"origin": {
"channel": "landing_form",
"source": "example.com/north/service",
"campaign": "spring-north"
},
"branch_code": "ACME-NORTH",
"fields": {
"message": "Requested an evening slot."
}
}4. Events
| Event | Sent when |
|---|---|
lead.created | A new lead is captured on any channel. |
lead.updated | Contact details or qualifying fields change. |
lead.stage_changed | The lead moves to another pipeline stage. |
5. Signature
signature = HMAC_SHA256(secret, timestamp + "." + raw_body)
header = "sha256=" + hex(signature)Reject any request whose timestamp falls outside a 300 second window, and compare signatures in constant time.
6. Delivery and retries
AES treats any 2xx response as accepted. Any other status, or a timeout of more than 10 seconds, is retried with exponential backoff for up to 24 hours. Because delivery is at-least-once, the receiving endpoint must deduplicate on event_id.
Repeated failure over the full retry window disables delivery and raises an alert in the customer’s panel. Delivery resumes when the endpoint is corrected and re-enabled.
7. Versioning
New fields may be added without notice and unrecognised fields should be ignored. No field is removed or changes meaning within the same major version.
Contact
Questions about this specification: developers@omb.cloud.