Webhooks

MortgageMeter posts to your URL on every meaningful event — leads, sheet views, verified scenarios. Subscribe to one or more events from /settings/developer. Each request is signed so you can confirm it came from us.

Signing#

Every POST carries an x-mortgagemeter-signature header in this format:

x-mortgagemeter-signature: t=1716000000,v1=<hmac_sha256(timestamp + "." + raw_body, webhook_secret)>

Verify with the same HMAC-SHA-256 against the raw request body:

# verify in Bash via openssl
SIG=$(echo -n "$TS.$BODY" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | awk '{print $2}')
echo "expected: $SIG"

Retries#

On any non-2xx response or 5s timeout, MortgageMeter retries three times: after 30s, then 5min, then 30min. After three failures the delivery is marked failedand surfaced in the developer portal's deliveries page.

Payloads#

See the payload reference for per-event schemas.