Webhooks

Webhooks push events from Cavyro to any URL you choose, so your backend, Zapier, Make, or n8n can react the moment something happens. There are 67 events across deals, contacts, companies, campaigns, meetings, projects, folders, task lists, tasks, and workflows.

Subscribing

In Settings → Webhooks, an admin registers a receiver with New webhook: a URL, an optional label, and the events to receive. Everything is also available over the REST API if you prefer scripts.

Subscriptions can be paused without deleting them, and the list shows when each one last fired.

Event reference

Event	Fires when
deal.created	A new deal is saved
deal.updated	Any deal field changes
deal.deleted / deal.restored	A deal moves to or comes back from the recycle bin
deal.status_changed	The status flips between open, won, and lost
deal.won / deal.lost	A deal closes, by update or by moving into a won/lost stage
deal.stage_moved	A deal moves to another pipeline stage
deal.assignees_changed	An assignee is added or removed
deal.tag_added / deal.tag_removed	A tag changes on a deal
contact.created / contact.updated	Contact lifecycle
contact.deleted / contact.restored	A contact moves to or comes back from the recycle bin
contact.tag_added / contact.tag_removed	A tag changes on a contact
company.created / company.updated	Company lifecycle
company.deleted / company.restored	A company moves to or comes back from the recycle bin
company.tag_added / company.tag_removed	A tag changes on a company
campaign.replied	A contact replies to a campaign message within its attribution window
campaign.completed	A campaign delivers or resolves its last recipient
calendar_event.created	A new meeting appears on a connected Google Calendar
project.created / project.updated	Project lifecycle
project.deleted / project.restored	A project moves to or comes back from the recycle bin
project.status_changed	The status moves between active, on hold, completed, and archived
project.completed	A project is completed. meta says how many tasks were still open
project.reopened / project.archived	A project is reopened or archived
project.members_changed	The member list changes
project.tag_added / project.tag_removed	A tag changes on a project
folder.created / folder.updated	Folder lifecycle
folder.deleted / folder.restored / folder.archived	A folder is binned, restored, or archived with its lists
task_list.created / task_list.updated	Task list lifecycle
task_list.deleted / task_list.restored / task_list.archived	A task list is binned, restored, or archived
task_list.moved	A task list moves to another folder or project
task.created / task.updated	A task or subtask is created or changed
task.deleted / task.restored	A task moves to or comes back from the recycle bin
task.status_changed	A task moves to another workflow status
task.completed / task.reopened	A task moves into or out of a closed status
task.assignees_changed	An assignee is added or removed
task.moved	A task moves to another list, project, or parent
task.linked / task.unlinked	A task is linked to or unlinked from a deal, contact, or company. meta carries the record
task.tag_added / task.tag_removed	A tag changes on a task
workflow.created / workflow.updated	A workflow, or one of its statuses, is created or changed
workflow.deleted / workflow.restored	A workflow moves to or comes back from the recycle bin

A few rules that keep external mirrors honest:

• A delete or restore fires only its dedicated event, never a misleading *.updated.
• A hard delete from the recycle bin adds nothing: the record already reported *.deleted when it was binned.
• Bulk imports (and their undo) never fire webhooks, so a 5,000-row import doesn’t flood your receiver.

The payload

Every delivery is a JSON POST with three parts:

• data: the full record, same attributes as the REST API.
• changes: what changed, as {"field": [from, to]}. Filled for update-flavored events, empty for lifecycle ones.
• meta: event context. The tag on tag events, the campaign on campaign.replied, recipient stats on campaign.completed.

So a deal.updated receiver knows exactly which fields moved, and a campaign.replied receiver knows which campaign got the reply without a second API call.

Verifying deliveries

Every subscription gets a signing secret, shown once when you create it. Deliveries carry an X-Cavyro-Signature header (HMAC-SHA256 of the raw body), so your endpoint can verify the call really came from Cavyro before trusting the payload. Respond with any 2xx within 10 seconds; failed deliveries retry automatically.

Webhooks from automations

Automations can also send webhooks as an action, including Slack and Discord formatted messages, with full control over when they fire. Use a subscription for “mirror everything of this type”; use an automation when you want conditions, waits, and templated payloads. See Automations.