Leads: inbox & webhook

Status: Live

Every human handoff becomes a lead: it lands in your Inbox and — if you’ve configured one — fires your lead webhook. No node to wire; it’s built into the handoff itself.

Zapito deliberately does not build a CRM. A support agent’s job is to answer what it can and hand you the rest — so instead of pipelines and ticket fields, every human handoff is surfaced as a lead in two places: an inbox in the app, and one generic outbound webhook that delivers it to whatever you already use (Zapier, Make, HubSpot, your own endpoint).

(The old Log to CRM canvas node remains a pass-through and no ticket integration is coming — the inbox + webhook is the design.)

The lead inbox

Inbox in the app lists your conversations:

• Contacts show up by name — the WhatsApp profile name or Telegram name — so a lead is a person, not an ID.
• The Needs a human filter shows exactly the conversations the agent escalated.
• Opening one shows the full transcript, so you can pick up where the agent left off.
• Mark resolved closes the handoff — and un-silences the bot in that conversation, so it answers the customer’s next message again.

The outbound lead webhook

Configure it under Settings → Integrations: an endpoint URL and a signing secret. On every handoff, Zapito POSTs JSON like this:

{
  "event": "lead.handoff",
  "at": "2026-07-01T12:00:00.000Z",
  "reason": "escalate",
  "bot": { "id": "bot_…", "name": "Luna Café" },
  "conversation": {
    "id": "conv_…",
    "channel": "whatsapp",
    "externalId": "5511999990000",
    "contactName": "Maria",
    "status": "handoff"
  },
  "transcript": [
    { "role": "user", "content": "Can I talk to a person?", "at": "2026-07-01T11:59:41.000Z" },
    { "role": "assistant", "content": "Connecting you with a team member right away.", "at": "2026-07-01T11:59:44.000Z" }
  ]
}

• transcript is the last 10 messages of the conversation, oldest first.
• reason says which trigger opened the handoff door: handoff (the flow’s handoff node), escalate (the model asked for a human), model_error, or out_of_credits. Test events use test.

Verifying the signature

Every request carries X-Zapito-Signature: sha256=<hex> — the HMAC-SHA256 of the raw request body, keyed with your signing secret. Compute the HMAC over the exact bytes you received and compare; reject anything that doesn’t match. (X-Zapito-Event: lead.handoff is also sent for easy routing.)

Delivery

• One attempt, then one retry after 30 seconds if your endpoint doesn’t return a 2xx. The delivery outcome (sent / failed / skipped) is recorded on the handoff event.
• The webhook never delays your customer’s conversation — it’s fired after the handoff message is already sent.
• Use the Send test event button in Settings → Integrations to post a sample payload and check your endpoint end to end.