Webhooks and API keys
What this page is — the API keys that let an outside system create leads, and the log of everything it has sent.
What it is for — connecting a website, a landing page or a partner feed to Pulse, with one revocable key per integration.
The problem it solves — enquiries arriving somewhere other than Pulse and being retyped or lost. The log is the answer to "the integration says it worked and I cannot find the lead", which is the question this screen exists to settle.
Route: /org/marketing/leads/settings?tab=webhooks
View keys and logs: View API keys and logs · Create and revoke: Create/delete API keys
1. What a key is for
One key per integration, so a single misbehaving source can be revoked without breaking the others.
| API key | User session | |
|---|---|---|
| Used by | An external system | A person in a browser |
| Grants | Lead creation through the webhook only | Whatever the role allows |
| Revocable individually | Yes | Via the user's role |
2. Field reference
| Field | Notes |
|---|---|
| Name | Which integration this key is for |
| Key | Shown once, at creation. Copy it then — it is not retrievable afterwards |
| Status | Active or disabled. Disabling stops the key without deleting its log history |
| Created | Timestamp |
Disabling stops traffic and keeps the log. Deleting removes the key; keep the log if you may need to audit what that integration sent.
3. The logs
Each entry records the submission, the key used, and the outcome. Opening one shows the detail — which is the fastest way to diagnose an integration that thinks it is working.
| Log shows | Means |
|---|---|
| Rejected, validation | No name, or neither email nor phone |
| Rejected, auth | Key missing, revoked or disabled |
| Accepted, existing lead | De-duplication matched — submission_count incremented |
| Accepted, new lead | A lead was created |
It matches on email, phone or external_id before creating a lead. The CSV import does not, and neither
does creating one through the API. See import.
4. Permissions
| Action | Enforced |
|---|---|
| List keys, view a key, view logs | View API keys and logs |
| Create, delete, toggle a key | Create/delete API keys |
5. The admin contract
| Needs | Or |
|---|---|
| A key | Every inbound request is rejected |
| A lead source to reference | Inbound leads have no attribution |
| A pipeline and status named in the payload | Inbound leads appear on no board |
| Custom field definitions matching the keys you send | Requests naming an unknown key are rejected |
6. Downstream
Inbound leads appear in the list immediately, are routed by assignment rules, and are scored on arrival.
7. Don't confuse this with…
| This | Not this |
|---|---|
| These API keys | Orbit's public API keys for the external API platform |
| Webhook logs | The lead's activity timeline |
| Inbound webhook | Outbound webhooks that notify other systems |
8. Troubleshooting
| Symptom | Cause |
|---|---|
| Integration gets 401 or 403 | Key disabled, deleted, or not sent |
| Key value lost | It is shown once. Create a new key. Section 2 |
| Leads arrive with no source or board position | The payload omits the source, pipeline or status. Section 5 |
| Repeat submissions create no lead | De-duplication is working. Section 3 |
| Logs show accepted but no lead is visible | Wrong project selected |