Outbound events
Subscribe any HTTPS endpoint to canonical OpsIQ events, with filters per destination.
🪝 Webhooks & automation
Trigger anything, anywhere.
Subscribe an HTTPS URL to the OpsIQ events it needs. Every delivery is HMAC-SHA256 signed, workspace-scoped and tracked through a six-attempt retry lifecycle. Build rules visually, receive mapped events, or call governed actions through the General API.
31 canonical eventsHMAC-SHA256 on every deliveryInitial attempt + five retriesStable delivery ID across retries
Signed at the source
Retries until it lands
Live
31canonical events to subscribe
HMACsigned on every delivery
5×scheduled retries after the initial attempt
Scopedendpoints and logs locked to one workspace
Event router
Events out. Events in. Actions both ways.
A governed integration control room for three distinct paths: signed outbound deliveries, verified inbound receipts, and explicit backend action contracts.
Inbound receipts
Verify signed JSON, map its fields and attach accepted activity to the right contact.
Governed actions
Declare parameters, authentication, permissions and confirmation requirements per operation.
OpsIQ event bus signed traffic
One bus, three directions
Outbound
webhooks
webhooks
Inbound
events
events
Signed
event bus
event bus
Action
POST
POST
invoice.paidyour-crm.com/hook200stripe.payment_intentcontact timelinemappedai.action.approved/api/provisionsignedSignatureHMAC-SHA256
Every delivery carries headers receivers can verify with a constant-time compare.
CorrelationStable ID
X-OpsIQ-Delivery identifies the same delivery across every retry attempt.
HistoryInspectable
See status, attempt count, response snippet and retry timing for each outbound delivery.
Reliability · retries
Endpoints go down. Deliveries keep trying.
A failed delivery moves through a defined ladder (1m → 5m → 30m → 2h → 12h). That gives each event one initial attempt plus five scheduled retries. The delivery history keeps the HTTP status, response snippet, attempt count, next retry time and a stable delivery ID your receiver can use for deduplication.
Defined backoff: five scheduled retries (1m → 5m → 30m → 2h → 12h) after the initial request, then the delivery is marked failed.
Per-endpoint delivery rail: the last deliveries green / amber / red at a glance, with status code and time.
At-least-once, made explicit: verify the signature, reject stale timestamps and deduplicate the stable
X-OpsIQ-Delivery value in your receiver.14h 36mthrough the final attempt
6maximum total attempts
Backoff1m → 5m → 30m → 2h → 12h
Correlationstable delivery ID across attempts
Receiver safetytimestamp check + delivery-ID dedupe
Two-way automation
Receive events, and let AI act safely.
Inbound endpoints and action endpoints are different surfaces, so they now look different: one maps outside events onto contacts, the other gates AI actions before your backend is called.
Outside events land on the right timeline.
Create a unique URL and signing secret, map the JSON fields, then let OpsIQ attach each accepted event to the matching contact.
https://opsiq.example/api/v1/inbound.php?t=wh_7c91...
contact_email_path
$.customer.email
event_type_path $.type
idempotency_key_path $.id
AI can request work without escaping the contract.
Declare parameters, authentication and permissions; require confirmation for high-risk writes before execution.
billing.issue_creditProposeConfirmExecute
Keys with permissions, limits and allowlists.
Issue workspace keys for tools and partners without giving every integration full power.
BI dashboard Read only
Partner app Restricted
Internal tool All
Code paths stay clean.
For complex workflows, call the REST API directly with the same scoped model.
POST /api/v1.php
Authorization: Bearer opq_workspace_key
{ "action": "crm.conversions.record" }
Authorization: Bearer opq_workspace_key
{ "action": "crm.conversions.record" }
Hardened isolation
Every endpoint and key is welded to its workspace.
Security has its own visual system here: delivery URLs are guarded against SSRF, keys are scoped to one workspace, and cross-tenant requests bounce before any data is read.
0global tokens
403scope mismatch
Delivery URLs cannot turn inward.
OpsIQ blocks private, loopback, link-local and cloud metadata targets at save time and again at send time.
your-crm.comallow
127.0.0.1block
10.0.0.5block
169.254.169.254block
Tenant boundaries are part of the key.
Endpoints, inbound receipts, delivery logs and API keys all carry the workspace stamp that created them.
Workspace Akey opq_a1...
endpoint /hook-a
scope_key ws_a
endpoint /hook-a
scope_key ws_a
Workspace Bkey opq_b7...
endpoint /hook-b
scope_key ws_b
endpoint /hook-b
scope_key ws_b
A key from workspace A calling workspace B returns 403 before data access.
Every request crosses the same gate.
Signature, workspace scope, permission mode, rate limit and optional IP allowlist are checked before the request reaches business data.
Everything in the box
One integration surface, fully wired.
Outbound events
Subscribe any HTTPS URL to 31 canonical events, filtered per endpoint and signed with HMAC-SHA256.
Inbound endpoints
A unique URL + secret per source; signature-verified and mapped onto the right contact timeline.
Action contracts
Declare parameters, authentication, permissions, confirmation policy and audit behavior for backend operations.
⚖️ Where it fits
Not a glue tool you rent. A native integration layer.
Zapier and Make are great for taping apps together, but they sit outside your platform, can't gate AI actions, and meter every run. OpsIQ's events, signatures and actions are native, sharing the same data as your chat, CRM and tickets.
| What you need | Raw Zapier / Make | OpsIQ Webhooks & Actions |
|---|---|---|
| Typed, documented event catalog | Per-app, inconsistent | 31 canonical OpsIQ events |
| HMAC-SHA256 signed delivery | Rare / DIY per zap | Signed every delivery, secret per endpoint |
| Per-endpoint event filters | One trigger per zap | Wildcard or precise subset, per URL |
| Automatic retries + history | Limited / paid tier | Initial attempt + five scheduled retries |
| Safe duplicate handling | You build it | Stable delivery ID + signed timestamp |
| Inbound onto the right contact | Lands in a flow, not a CRM | Maps to the contact timeline |
| Gate AI actions before they run | No concept | Risk-aware confirmation policy |
| Audited action execution | No | Parameters redacted + result and duration logged |
| Scoped API keys + rate limits | Account-wide token | All / Read-only / Restricted + CIDR |
| SSRF-hardened delivery | Varies | Private / metadata IPs blocked, re-resolved |
| Per-run metering / task caps | Yes, you pay per task | Native: no per-event toll |
| Same data as chat / CRM / tickets | Copied between apps | One source of truth |
Full feature list
Everything in Webhooks & Actions.
Every capability, grouped. ★ marks a stand-out.
| Feature | What it does |
|---|---|
| Event subscription | |
| Outbound Event Catalog (31) ★ | Typed canonical events across commerce, billing, support, CRM, security and analytics. |
| Wildcard Event Subscription (*) | Subscribe an endpoint to everything with a single *. |
| Per-Endpoint Event Filters ★ | One URL gets billing, another support, so no noise on receivers that don't need it. |
| Security & signing | |
| HMAC-SHA256 Signing ★ | Every payload signed with a per-endpoint secret via X-OpsIQ-Signature. |
| Raw-Body Signature | Signs the bytes, not a re-serialised object, so nothing drifts between sender and receiver. |
| Constant-Time Verification Recipe ★ | hash_equals() guidance so attackers can't time their way to a forged signature. |
| Rotatable Signing Secrets ★ | Regenerate a per-endpoint secret at any time, then update your verifier. |
| X-OpsIQ-Signature Header | HMAC carried on every single delivery for verification. |
| X-OpsIQ-Timestamp Header | Unix epoch on each delivery so receivers can reject stale events. |
| Endpoint SSRF Protection ★ NEW | Blocks private, loopback and cloud-metadata IPs as delivery targets, at save and at send time. |
| Receiver Replay Controls ★ | A signed Unix timestamp and stable delivery ID give receivers the inputs to reject stale requests and deduplicate attempts. |
| Reliability & retries | |
| Stable Delivery Identifier ★ | X-OpsIQ-Delivery remains stable across retries so a receiver can make writes idempotent. |
| Exponential Backoff Retry Ladder ★ | 1m → 5m → 30m → 2h → 12h: five scheduled retries after the initial attempt. |
| Delivery History ★ | HTTP status, response snippet, attempt count and next retry time, colour-coded green / amber / red. |
| Per-Endpoint Delivery Rail | The last deliveries shown with status at a glance, per endpoint. |
| Delivery metadata | |
| X-OpsIQ-Event Header | Carries the event type so receivers can route without parsing the body. |
| X-OpsIQ-Delivery Header | A delivery ID for tracking and correlating each attempt. |
| Testing & validation | |
| Test Delivery Before Going Live ★ | Fire a sample payload and inspect the exact JSON, signature and HTTP response. |
| Test Signatures (dry_run) | Returns the signed envelope without posting, so you can verify locally first. |
| Inbound Test Delivery | Confirm a mapping extracts the email and creates the right activity. |
| Endpoint management | |
| Active / Inactive Toggle | Pause an endpoint without deleting it. |
| Deletion with Pending Cancellation | Deleting stops pending retries while keeping the logs. |
| Inbound webhooks | |
| Inbound Endpoints ★ | A unique URL plus secret per source for a system or relay that can HMAC-sign the raw JSON body. |
| Inbound Signature Verification ★ | Verifies X-OpsIQ-Inbound-Signature before anything else happens. |
| JSON Path Mapping ★ | Extract email, event type and value via $.path from any payload shape. |
| Contact Name Extraction NEW | Pull the contact's name with contact_name_path so the timeline reads cleanly. |
| Value Field Extraction NEW | Map a monetary or numeric value with value_path for scoring and reporting. |
| Summary Templates ★ NEW | Build a human summary from summary_path or a ${path} token template. |
| Inbound Preset Mappings ★ | One-click Stripe, Calendly and Zapier mappings prefilled. |
| Inbound Idempotency ★ | When idempotency_key_path resolves an event ID, duplicate receipts return success without creating another activity. |
| Inbound Activity on Contact Timeline ★ | Accepted events become scorable, triggerable activities on the contact. |
| Inbound Receipt Log | ok / error / duplicate / unmapped with the raw payload for debugging. |
| API & access control | |
| API Keys: 3 Permission Modes ★ | All for trusted tools, Read-only for dashboards, or Restricted to block specific actions. |
| API Key Rate Limiting ★ | Calls-per-hour per key with a live usage bar. |
| API Key IP Allowlist (CIDR) ★ | Pin a key to office or data-centre IPs with CIDR ranges. |
| Live Action Catalog (meta.actions) ★ | Discover the full action menu a key can call; no key required to list. |
| Workspace-Locked API Keys ★ NEW | Every key is locked to its creating workspace, so multi-tenant isolation is automatic. |
| API Key Revocation (Instant) ★ | Revoke a leaked key and its calls fail immediately. |
| Automation rules | |
| Workflows with Webhook Step | POST to a URL as one step inside a multi-step automation. |
| Visual Rule Builder ★ | Drag-drop conditions and actions: when X happens, do Y, no code. |
| Action endpoints | |
| Action Contracts ★ | Each operation declares parameters, delivery type, authentication and response handling. |
| Permission-Gated Execution ★ | Actions can require an operator permission; API calls also enforce their registered least-privilege scopes. |
| Risk-Aware Confirmation ★ | High-risk and destructive Gateway actions require confirmation; AI cannot auto-run destructive work. |
| Action Execution Log ★ | When auditing is enabled, OpsIQ records redacted parameters, status, result, duration and deployment evidence. |
| Configurable HTTP Authentication ★ | Remote actions can use Bearer, API-key, Basic or HMAC authentication; redirects and unsafe targets are blocked. |
| Multi-tenancy | |
| Endpoint Scope Isolation ★ NEW | scope_kind/scope_key weld every endpoint, key and log row to its workspace. |
FAQ
Webhook questions, answered.
Everything teams ask before they wire OpsIQ to the rest of their stack: signing, retries, inbound and actions.
Compute HMAC-SHA256 over the raw request body using your shared secret;
X-OpsIQ-Signature is that hex digest with no prefix. Compare with a constant-time check such as hash_equals(). Sample code is on the developers page and in the signing section above.After the initial request, OpsIQ schedules up to five retries: 1m → 5m → 30m → 2h → 12h. If attempt six fails, the delivery is marked failed. The history retains its status, response snippet and attempt count for diagnosis.
Yes. Each endpoint has its own secret you can regenerate at any time: rotate it, then point your verifier at the new secret.
Yes. The visual rule builder ("when X happens, do Y") covers most workflows, with conditions on customer tier, priority or keyword. Code-only paths via the REST API are available for complex cases.
31 canonical events span commerce, billing, support, CRM, security and analytics, for example
order.created, payment.completed, invoice.paid, subscription.renewed, ticket.created, crm.deal.won and analytics.anomaly. Each endpoint can subscribe to * or a precise subset.Yes. Create an inbound endpoint to get a unique URL and signing secret, choose a Stripe, Calendly or generic field-mapping preset, then have the sending system or relay HMAC-sign its raw JSON. OpsIQ verifies the signature, extracts the contact email and adds the accepted activity to that contact.
A remote action is an explicit operation contract for your backend. It declares parameters, authentication, permissions, confirmation policy and response handling. High-risk Gateway actions require confirmation, AI cannot auto-run destructive actions, and execution logging can retain redacted evidence.
Issue keys for the REST API and pick a permission mode per key: All, Read only, or Restricted (block specific actions, including wildcards like
crm.contacts.*). Add a per-hour rate limit and an optional IP allowlist. Every key is locked to the workspace it was created in.Outbound webhooks use at-least-once delivery. Verify the raw-body signature, reject an old
X-OpsIQ-Timestamp, then persist X-OpsIQ-Delivery before applying a write. If that delivery ID was already committed, return a 2xx response without repeating the operation.