CRM webhooks

A webhook is an HTTP POST Instant Roofer sends to a URL you choose each time one of these events happens for your company:

Event	productSourceCombo	What triggers it	Homeowner data
Exclusive Leads	estimate_subscription	A homeowner on InstantRoofer.com requested an estimate and the lead was awarded to you	Yes
Calculator Embed	estimate_embed	A homeowner used the Website Calculator on your site and left their details	Yes
Contact Form Embed	contact_embed	A homeowner submitted the Contact Form on your site	Yes
Online Scheduler Embed	repair_embed	A homeowner booked a repair visit through the Online Scheduler	Yes
Instant Measure	estimate_manual	Your team generated an AI Instant Measure report (dashboard, mobile app, or measure_roof)	No

Webhooks are how most contractors connect Instant Roofer to a CRM (JobNimbus, AccuLynx, HubSpot, GoHighLevel, ServiceTitan, and so on), to Zapier/Make/n8n, or to a small endpoint of their own. With the webhooks:manage permission your assistant can build both halves: the receiving endpoint and the Instant Roofer webhook that feeds it.

What the assistant can do

• list_webhooks / get_webhook: see every webhook, its events, URL, header names, body-parameter mappings, configuration warnings, and example requests rendered exactly as production sends them. get_webhook can also return the same Markdown integration brief the dashboard's Copy AI Agent Instructions button produces.
• get_webhook_field_reference: every field that can be mapped into the body, with its type and which events populate it.
• create_webhook: creates a webhook, disabled by default. Inspection, a real test send, and enabling automatic deliveries are distinct actions; a setup request alone does not authorize sending.
• test_webhook: defaults to mode: "preview", which builds a redacted request without contacting the destination. Use mode: "send" only after the user explicitly authorizes a real test for that webhook and event. It sends one POST with fake event data, stored authentication/custom values and the header X-Instant-Roofer-Webhook-Test: true; it may trigger receiver workflows even while the webhook is disabled. Results omit response bodies and credentials. Repeating a send may repeat side effects; do not automatically retry.
• update_webhook: changes the authorized parts of the configuration, including enabling (active: true) or pausing it. Enabling requires user agreement to automatic deliveries, including homeowner contact details for lead events.
• delete_webhook: removes it.

All of these require the Full admin team-member privilege, exactly like the dashboard's CRM Integration tab. Everything the assistant does is recorded in the AI Assistants usage log.

Configuration model

Each webhook has an id, a name, the request uri, an active flag, the selected events, a body format (json or form), custom request headers (normally one authentication header), and bodyParams: the keys that appear in the request body and where each value comes from (a preset field, a fixed custom value, or a selected_preset_field_summary blob). Only mapped keys are sent, and a key is omitted when its value is empty for that submission.

Credentials

Requests are not signed. The destination should verify a secret header (for example X-Api-Key) that you also store in its configuration. Use the dashboard to enter an existing secret, or have the assistant generate a fresh integration secret. Authentication header values and all fixed custom body values are hidden in tool results; safe headers such as Content-Type may remain visible. Updates keep stored values when a field is supplied by name alone. Destination URL paths and query strings are hidden in previews, and test responses omit arbitrary destination content.

Delivery rules

• Lead events are delivered only from production, after the homeowner's confirmation email is confirmed delivered (or immediately if you disabled that email).
• Instant Measure events are delivered from every environment right after a successful report, including reports run through measure_roof, and never for freemium accounts.
• Each event is delivered once per webhook: no retries and no signing. The destination should store the body first and respond 2xx within a few seconds; the response body is ignored.
• Webhook URLs must use HTTPS without URL username/password credentials and must be public: private, loopback, and link-local addresses are rejected when a webhook is created, updated, activated, or tested. Legacy insecure hooks can be disabled or deleted; fix their destination before enabling delivery.

Where it shows up in the dashboard

The same webhook list appears under Lead Generation → InstantRoofer.com Leads → CRM Integration, Tools For Your Website → Website Calculator / Website Contact Form / Online Scheduler → CRM Integration, and Roof Measurements → AI Instant Measure Reports → Webhook Integration. Anything the assistant creates or changes is visible and editable there, and vice versa.