Lead webhooks

Subscribe a URL to receive leads the moment they're captured — no polling. Two events are available:

Subscribe

POST /api/zapier/hooks

curl -X POST https://www.neighborstack.com/api/zapier/hooks \
  -H "X-API-Key: nbs_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "event": "lead.created", "targetUrl": "https://example.com/hooks/neighborstack" }'

// 201 Created
{ "id": "clx...", "event": "lead.created", "secret": "9f2c..." }

targetUrl must be HTTPS. The secret is returned once — store it to verify deliveries. Up to 25 active subscriptions are allowed per account.

Unsubscribe

DELETE /api/zapier/hooks/:id

Idempotent — deleting an already-removed subscription still returns 200.

Deliveries

Each delivery is a POST of a single Lead object with two headers: X-NeighborStack-Event (the event name) and X-NeighborStack-Signature — the hex HMAC-SHA256 of the raw request body, keyed with your subscription secret:

const crypto = require('crypto');
const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
const valid = expected === req.headers['x-neighborstack-signature'];