Outbound Webhooks

An outbound webhook is a URL of yours that Revnu POSTs to when something happens on LinkedIn: an invite goes out, someone accepts, or someone replies. Use it to keep a CRM in step with Revnu's LinkedIn outreach without polling. For other changes, such as email replies or new leads, poll the API.

(For the other direction, where your systems wake Revnu, see Inbound Webhooks.)

1. Add an endpoint

1. In the dashboard, open Settings → Developers and find Outbound Webhooks.

2. Click Add Endpoint, paste an https:// URL, and pick the events you want.

3. Copy the signing secret it shows (whsec_...). You can read it again any time with Signing Secret.

4. Click Send Test. A ping event arrives at your URL, and the result shows under Deliveries.

An account can have five endpoints. The URL must be public https; private addresses and redirects are refused.

Events

LinkedIn doesn't tell anyone when an invite is accepted. Revnu checks its pending invites about once a day, so linkedin.invite_accepted fires when that check finds the connection, and occurredAt is the time it was found. Later replies in the same conversation don't fire again. Events cover what Revnu sent, so invites you send yourself in LinkedIn aren't included.

Payload

Every event is a JSON POST like this:

{
  "id": "evt_6f0c2b9e1d4a47c8a1e35b2d90f7c164",
  "type": "linkedin.invite_accepted",
  "createdAt": 1792656000000,
  "data": {
    "occurredAt": 1792655990000,
    "linkedinProfile": "dana-smith-4b1a2",
    "lead": { "id": "k57c8w0y3m2...", "companyName": "Acme", "domain": "acme.com" },
    "contact": {
      "id": "jd7f2q9x1v8...",
      "name": "Dana Smith",
      "linkedinUrl": "https://www.linkedin.com/in/dana-smith-4b1a2"
    }
  }
}

For the full LinkedIn history of a lead (invited, accepted, last message, seen, replied and the next step), read linkedin on GET /leads/{id}.

Verify the signature

Each request carries these headers:

v1 is the HMAC-SHA256 of <t>.<raw body> with your signing secret as the key. Compute it over the raw bytes you received, before parsing the JSON:

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyRevnu(rawBody: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=") as [string, string]));
  const t = Number(parts.t);
  // Refuse anything older than five minutes so a captured request can't be replayed.
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const got = parts.v1 ?? "";
  return got.length === expected.length && timingSafeEqual(Buffer.from(got), Buffer.from(expected));
}

Responding and retries

Answer with any 2xx within 15 seconds to confirm you received the event. Anything else, a redirect or a timeout counts as a failure, and Revnu tries again after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 1 day: eight tries over about two days. After the last one the event shows as Failed under Deliveries, where Resend sends it again with the same id.

Revnu may deliver an event more than once, and events can arrive out of order. Store each id you've handled and skip repeats. To get the current state rather than the latest change, read GET /leads/{id}.

Do the slow work after you reply: return 200 first, then update your CRM.

Turning it off

Disable stops sending to the endpoint. Events that happen while it's off aren't sent later; read GET /leads to catch up. Delete removes the endpoint and its delivery history.