Configure Automation Webhooks

Configure Leadping automation HTTP requests and handle tracing, timeouts, retries, and duplicate delivery safely.

The Webhook/API call automation action sends an HTTP request to a public HTTPS endpoint.

Leadping automation webhooks do not currently include Standard Webhooks signature headers. Do not expect webhook-id, webhook-timestamp, or webhook-signature, and do not treat the built-in tracing headers as proof of origin.

Configure the action

Setting	Behavior
Method	GET, POST, PUT, or PATCH
Endpoint URL	Must be an absolute public HTTPS URL; localhost and loopback URLs are rejected
Headers	Optional Name: Value lines; automation variables are supported
Body	Required for methods other than GET; automation variables are supported
Content type	Defaults to application/json
Timeout	1–30 seconds; defaults to 10 seconds
Retries	0–3 additional attempts

Leadping rejects unknown template variables and an empty rendered body for POST, PUT, or PATCH.

Built-in request headers

Every request includes:

User-Agent: Leadping-Automation/1.0
X-Leadping-Event: <event type>
X-Leadping-Automation-Id: <automation id>
X-Leadping-Run-Id: <run id>
X-Leadping-Action-Id: <action id>

Use these values for logging and correlation. Because a caller can copy them, they are not authentication credentials.

Retries

When retries are configured, Leadping retries:

• request timeouts;
• HTTP 408;
• HTTP 429; and
• HTTP 5xx responses.

Other non-success responses fail the action without a retry. A successful 2xx response completes it.

The same automation run and action identifiers are reused across attempts. Design the receiver to deduplicate on those identifiers when repeating the side effect would be harmful.

Secure the receiver

• Expose only an HTTPS endpoint intended for this integration.
• Validate the expected content type and payload shape.
• Reject unknown automation or action identifiers when your application can maintain an allowlist.
• Apply request-size, timeout, and rate limits.
• Log identifiers and response status without logging sensitive lead data.
• Make processing idempotent.

Authentication headers such as Authorization, Cookie, Api-Key, X-Api-Key, and X-Leadping-Webhook-Token cannot be entered as ordinary action headers. If the receiver requires authenticated or signed delivery, do not rely on this action until Leadping exposes a supported credential or signing configuration for it.