Webhooks API

Webhooks are the primary way to send leads into 500 Leads. Each source gets a unique webhook endpoint that accepts JSON payloads.

Inbound webhook

POST /api/webhooks/:token

This endpoint does not require authentication. The :token in the URL acts as the authentication mechanism. You can find your token in the source detail page of your dashboard.

JSON payload

curl -X POST "https://leads.500rockets.io/api/webhooks/YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "firstName": "Jane",
    "lastName": "Smith",
    "phone": "+1234567890",
    "company": "Acme Corp"
  }'

Accepted fields

Field	Type	Description
email	string	Lead’s email address
firstName	string	First name
lastName	string	Last name
phone	string	Phone number
company	string	Company or organization name

All fields are optional, but providing at least an email is strongly recommended.

Any fields that do not match a known field are stored as custom metadata on the lead.

Field mappings

If your form or integration sends data with different field names (e.g., contact_email instead of email), configure field mappings on the source in your dashboard. Unmapped fields are stored as custom metadata.

Response

Success (200):

{
  "success": true
}

Errors:

Status	Cause
404	Invalid webhook token
400	Malformed or empty payload
429	Rate limit exceeded
500	Server error

What happens after submission

1. The lead is created (or matched to an existing duplicate)
2. The lead is enriched (email verification, geolocation, company inference)
3. AI analyzes the lead (scoring 0-100, qualification as hot/warm/cold)
4. If configured, team email notifications are sent
5. If the lead qualifies, it is auto-enrolled in matching sequences
6. The lead appears in your dashboard within seconds

Rate limits

Webhook endpoints are rate-limited to 100 requests per minute per IP address.

Using the JavaScript snippet (recommended)

For HTML forms on your own website, we recommend using the JavaScript snippet instead of direct webhook calls. The snippet handles form interception, error feedback, UTM tracking, and more automatically.

UTM and attribution

When using the JavaScript snippet, UTM parameters and referrer are captured automatically. When calling the webhook directly, you can include them in the payload:

{
  "email": "[email protected]",
  "_utm": {
    "utm_source": "google",
    "utm_medium": "cpc",
    "utm_campaign": "spring-2026"
  },
  "_referrer": "https://google.com"
}