Developers

Endpoints

Objects

Webhooks

Add an address in Settings → API & webhooks (or subscribe one through POST /api/v1/hooks) and choose the events. We POST each event as JSON within about a minute. data.object is the same shape the API returns.

{
  "id": "cm2x9q1ab0001",
  "type": "lead.created",
  "createdAt": "2026-10-22T14:03:00.000Z",
  "data": {
    "object": {
      "object": "lead",
      "id": "cm2x9q0zz0000",
      "status": "new",
      "name": "Sam Patel",
      "email": "sam@example.com",
      "eventDate": "2027-06-12",
      "quote": null,
      "createdAt": "2026-10-22T14:03:00.000Z"
    },
    "context": { "source": "Website" }
  }
}

Checking the signature

Every request has a Gig-Nest-Signature: t=<unix seconds>,v1=<hex> header. v1 is the HMAC-SHA256 of t, a full stop, and the raw body, keyed with the webhook's signing secret. Check it, and that t is recent:

import crypto from "node:crypto";

// rawBody: the request body exactly as received (a string, before JSON.parse)
// header:  the Gig-Nest-Signature header, e.g. "t=1792683600,v1=5f1c…"
// secret:  the webhook's signing secret (whsec_…)
export function verifyGigNest(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.trim().split("=")));
  const t = Number(parts.t);
  if (!Number.isInteger(t) || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSec) return false; // too old: a replay
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Delivery and retries

• Answer with any 2xx within ten seconds. We don't follow redirects.
• Anything else is retried: after 1 minute, 5 minutes, 30 minutes, 2, 5, 10 and 12 hours — eight tries over about a day.
• The Gig-Nest-Event-Id header (and the body's id) stays the same on every retry, so you can ignore one you've already handled.
• If an address has failed for a day, we switch it off and email the business owner. Answer 410 Gone to unsubscribe straight away.
• Addresses must be https and reachable on the public internet.

Events

• lead.created · New enquiry
• lead.replied · Client replied
• lead.lost · Lead marked lost
• quote.sent · Quote sent
• proposal.viewed · Proposal viewed
• proposal.accepted · Proposal accepted
• proposal.expiring · Proposal expiring soon
• proposal.expired · Proposal expired
• booking.confirmed · Booking confirmed
• booking.cancelled · Booking cancelled
• contract.sent · Contract sent
• contract.signed · Contract signed
• payment.received · Payment received
• payment.failed · Payment failed
• instalment.due · Instalment due
• invoice.issued · Invoice issued
• invoice.paid · Invoice paid
• invoice.overdue · Invoice overdue
• credit_note.issued · Credit note issued
• statement.issued · Crew statement issued
• meeting.booked · Call booked
• meeting.cancelled · Call cancelled
• call.answered · Receptionist answered a call
• call.question · Receptionist couldn't answer a question
• music.locked · Music plan locked
• webhook.test · the settings screen's test button

Zapier, Make and n8n

Already sending Facebook Lead Ads into Gig Nest through Zapier or Make? That inbound address keeps working exactly as before.