> ## Documentation Index
> Fetch the complete documentation index at: https://leadping.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Automation Webhooks

> Configure Leadping automation HTTP requests and handle tracing, timeouts, retries, and duplicate delivery safely.

The **Webhook/API call** automation action sends an HTTP request to a public HTTPS endpoint.

<Warning>
  Leadping automation webhooks do not currently include Standard Webhooks signature headers. Do not expect `webhook-id`, `webhook-timestamp`, or `webhook-signature`, and do not treat the built-in tracing headers as proof of origin.
</Warning>

## Configure the action

| Setting      | Behavior                                                                       |
| ------------ | ------------------------------------------------------------------------------ |
| Method       | `GET`, `POST`, `PUT`, or `PATCH`                                               |
| Endpoint URL | Must be an absolute public HTTPS URL; localhost and loopback URLs are rejected |
| Headers      | Optional `Name: Value` lines; automation variables are supported               |
| Body         | Required for methods other than `GET`; automation variables are supported      |
| Content type | Defaults to `application/json`                                                 |
| Timeout      | 1–30 seconds; defaults to 10 seconds                                           |
| Retries      | 0–3 additional attempts                                                        |

Leadping rejects unknown template variables and an empty rendered body for `POST`, `PUT`, or `PATCH`.

## Built-in request headers

Every request includes:

```http theme={null}
User-Agent: Leadping-Automation/1.0
X-Leadping-Event: <event type>
X-Leadping-Automation-Id: <automation id>
X-Leadping-Run-Id: <run id>
X-Leadping-Action-Id: <action id>
```

Use these values for logging and correlation. Because a caller can copy them, they are not authentication credentials.

## Retries

When retries are configured, Leadping retries:

* request timeouts;
* HTTP `408`;
* HTTP `429`; and
* HTTP `5xx` responses.

Other non-success responses fail the action without a retry. A successful `2xx` response completes it.

The same automation run and action identifiers are reused across attempts. Design the receiver to deduplicate on those identifiers when repeating the side effect would be harmful.

## Secure the receiver

* Expose only an HTTPS endpoint intended for this integration.
* Validate the expected content type and payload shape.
* Reject unknown automation or action identifiers when your application can maintain an allowlist.
* Apply request-size, timeout, and rate limits.
* Log identifiers and response status without logging sensitive lead data.
* Make processing idempotent.

Authentication headers such as `Authorization`, `Cookie`, `Api-Key`, `X-Api-Key`, and `X-Leadping-Webhook-Token` cannot be entered as ordinary action headers. If the receiver requires authenticated or signed delivery, do not rely on this action until Leadping exposes a supported credential or signing configuration for it.