Webhooks
Send leads and demo events to your CRM, Zapier, Make or your own backend.
ProPaid plan only, not in the free trial. Admins only.
A webhook sends a POST request to a URL of your choice when something happens in a demo. Use it to put leads in your CRM, post in Slack through Zapier or Make, or start your own automation.
Add a webhook
- Go to Leads → Webhooks, or Integrations → Webhooks.
- Click Add webhook.
- Enter the URL. It has to start with
https://. - Choose the events to send.
- Click Create webhook.
- Click Send test webhook to check that it arrives.
You can add up to 10 webhooks per workspace.
Events
| Event | When |
|---|---|
lead.captured | A viewer submits a form |
demo.engagement | A viewer views a step |
demo.completed | A viewer reaches the end of a demo |
cta.clicked | A viewer clicks a CTA button |
Payload
Every request has a JSON body like this:
{
"event": "lead.captured",
"timestamp": "2026-09-25T10:15:00.000Z",
"data": {
"demo": {
"id": "abc123",
"title": "Product tour",
"url": "https://share.peutly.com/abc123"
},
"lead": {
"email": "jane@example.com",
"name": "Jane Doe",
"firstName": "Jane",
"lastName": "Doe",
"phone": "",
"company": "Example Inc",
"country": "Netherlands",
"optIn": true,
"source": "cta"
}
}
}leadis filled in when the viewer submitted a form earlier in the same session, andnullotherwise.sourceisctafor the CTA step, oroverlayfor a form in an overlay step.- Fields the viewer didn't fill in are empty strings.
countryis the text the viewer typed. - The request has the headers
Content-Type: application/jsonandUser-Agent: Peutly-Webhooks/1.0.
Delivery and retries
Your endpoint has 10 seconds to answer with a 2xx status. If it doesn't, Peutly tries again after 1 minute, 5 minutes, 30 minutes and 2 hours: 5 attempts in total.
Click Delivery logs to see every request, its status code and any errors.
Security
Webhook requests are not signed yet. Anyone who knows your URL could send a fake request to it. To be safe:
- Use a long, random URL that's hard to guess, for example with a secret token in the path.
- Keep the URL private.
- Treat the data as untrusted until you've checked it.