Webhooks

Ereignisse, HMAC-Signatur und Payloads nach Anlage und Unterschrift.

Delivery is queued (3 tries, backoff 1/5/10 seconds). Signing is never blocked by a failed webhook.

Destination

  1. webhook_url on POST /api/leads (this lead only), otherwise
  2. the webhook URL stored on the partner in Integrationen.

Das Secret erzeugen Sie zusammen mit der URL unter Authentifizierung.

Wizard-created leads also emit lead.signed and additional_contract.signed when the owner has a stored webhook URL. lead.created is API-only.

Headers

Content-Type: application/json
X-Blinkos-Event: lead.signed
X-Blinkos-Signature: {hmac_sha256_hex}

X-Blinkos-Signature is HMAC-SHA256 of the raw JSON body with the partner webhook secret.

Example verification (PHP):

$hash = hash_hmac('sha256', $rawBody, $webhookSecret);
hash_equals($hash, $request->header('X-Blinkos-Signature'));

Events

lead.created

{
  "event": "lead.created",
  "id": "9b52d3f2-0000-4000-9000-000000000010",
  "status": "pending",
  "signing_url": "https://blinkos.de/signieren/...",
  "partner_id": "9b52d3f2-0000-4000-9000-000000000001",
  "created_at": "2026-09-24T09:00:00+00:00"
}

lead.signed — once after the customer completes the standard signing flow.

{
  "event": "lead.signed",
  "id": "9b52d3f2-0000-4000-9000-000000000010",
  "status": "completed",
  "signing_url": "https://blinkos.de/signieren/...",
  "contracts": [
    {
      "id": 1,
      "status": "completed",
      "partner_id": "9b52d3f2-0000-4000-9000-000000000001"
    }
  ]
}

additional_contract.signed — per Zusatzvertrag, not a replacement for lead.signed.

{
  "event": "additional_contract.signed",
  "id": "9b52d3f2-0000-4000-9000-000000000010",
  "signing_id": 12,
  "status": "signed",
  "contract_type_id": 4,
  "partner_id": "9b52d3f2-0000-4000-9000-000000000001",
  "signed_at": "2026-09-24T09:05:00+00:00"
}