Lead captured outbound delivery
When a lead is captured on one of your Mailr landing pages, Mailr POSTs
this payload to every subscription registered for lead.created. Only
landing-page leads are delivered; CRM-synced leads never are.
Signature verification. A subscription that carries a signing_secret
receives two headers:
X-Mailr-Timestamp: unix seconds, as sent.X-Mailr-Signature:sha256=<hex HMAC-SHA256>computed over the string"<timestamp>.<rawBody>", whererawBodyis the exact bytes of the request body.
Verify by recomputing the HMAC over "<X-Mailr-Timestamp>.<rawBody>" with
your secret and comparing in constant time, and reject timestamps drifting
more than 300 seconds from now (replay protection). Subscriptions with
a null secret are delivered without these headers.
Loop guard. The payload includes mailr_lead_id (equal to id). If
your automation later posts this record back to POST /api/v1/events,
stamp that value in record.properties.mailr_lead_id so Mailr recognises
its own lead and skips campaign matching.
Authorizations
Organization-scoped Mailr API key. Header: Authorization: Bearer ak_….
Body
Canonical enriched lead (same shape at the poll endpoint and the outbound webhook). Flattened custom_<field_id> keys are added dynamically.
Equal to id. Echo it back in record.properties.mailr_lead_id to trigger the loop guard.
Present and true only on the setup sample lead.
Normalized E.164 when parseable.
Street line.
Two-letter state; empty string when unknown.
"United States"
Street, city, state and postal joined into one line.
"Mailr"
Response
Mailr does not inspect your response status — a delivery is considered
attempted once the request completes. Non-2xx responses are ignored;
timeouts and blocked hosts are recorded in Mailr's server logs only (not
in your webhook log) and are not retried. Poll
GET /api/v1/integrations/leads to reconcile anything your endpoint dropped.