EXR Commercial API Webhooks

Webhooks

Supported events (36):

• deal.created
• deal.updated
• deal.deleted
• tenant.created
• tenant.updated
• tenant.deleted
• prospect.created
• prospect.updated
• prospect.deleted
• client.created
• client.updated
• client.deleted
• workspace.created
• workspace.updated
• workspace.deleted
• action.created
• action.updated
• action.deleted
• campaign.created
• campaign.updated
• campaign.deleted
• broker.created
• broker.updated
• broker.deleted
• brokerage.created
• brokerage.updated
• brokerage.deleted
• entity.created
• entity.updated
• agreement.created
• agreement.updated
• agreement.deleted
• agreement.sent
• agreement.signed
• agreement.completed
• agreement.voided

• Entities emit entity.created and entity.updated only; merge/dedupe is in-app and there is no entity.deleted event.
• Deal, tenant, prospect, workspace, and agreement CRUD events may originate from in-app or public API writes.
• Broker, brokerage, action, campaign, entity, and client events currently originate only from public API writes.
• Agreement sent, signed, completed, and voided events originate in the shared state machine and may be triggered in-app or through the public API.

Envelope

{ "id": "…", "type": "deal.created", "createdAt": "…", "apiVersion": "v1", "data": { "deal": { "…": "…" } } }

Delivery is attempted 4 times (immediate → +30 s → +2 min → +10 min), with a 10-second timeout per attempt. Any HTTP 2xx response acknowledges a delivery.

Signature verification

signedPayload = <t>.<rawBody>
v1            = HMAC-SHA256(signing_secret, signedPayload)  // hex
header        = X-EXR-Signature: t=<unix-ts>,v1=<hex>

Reject stale timestamps and compare the signature with a timing-safe comparison. Never put signing secrets in source control or browser code.