Perfex CRM Webhooks — 100+ Events, HMAC-Signed

Subscribe to every meaningful change in your Perfex CRM. Three processing modes, automatic retries, and a dead-letter queue — bundled with every PerfexAPI license from $49.

Why webhooks (and not polling)?

Polling a REST API every minute burns CPU on both ends and leaks the current state of your CRM to anyone watching the wire. Webhooks push a signed payload only when something actually changes — with latencies measured in milliseconds instead of minutes.

PerfexAPI ships 100+ webhook events across all 19 CRM resources. Every event carries the full resource payload, a unique delivery ID, a timestamp, and an HMAC-SHA256 signature so you never have to call back to verify authenticity.

Three processing modes

Pick the delivery semantics that match your workload — no other Perfex CRM module offers this.

Immediate

Fires on the request thread

Lowest latency. Best for low-volume installs or when the receiving endpoint responds in under 100ms.

Smart

Debounces rapid events

Collapses repeated events from the same resource within a 2-second window. Ideal for customer-edit flows where users save multiple times.

Async

Background queue worker

Queues delivery to a worker process. Request thread returns immediately. Recommended for production and for downstream endpoints with variable response times.

Full event catalog

The most common events are documented below. The module also ships internal events for advanced use cases — the full catalog totals 100+ hooks.

Customer

8 events
  • customer.created

    New customer record added

  • customer.updated

    Existing customer fields changed

  • customer.deleted

    Customer record removed

  • customer.contact_added

    Contact attached to customer

  • customer.contact_updated

    Contact details changed

  • customer.contact_deleted

    Contact removed

  • customer.note_added

    Internal note added to customer

  • customer.group_changed

    Customer group membership changed

Invoice

9 events
  • invoice.created

    New invoice issued

  • invoice.updated

    Invoice content changed

  • invoice.sent

    Invoice emailed to customer

  • invoice.paid

    Invoice fully paid

  • invoice.partially_paid

    Partial payment recorded

  • invoice.overdue

    Due date passed without payment

  • invoice.cancelled

    Invoice cancelled

  • invoice.deleted

    Invoice removed

  • invoice.payment_added

    New payment linked to invoice

Lead

8 events
  • lead.created

    New lead captured

  • lead.updated

    Lead fields changed

  • lead.assigned

    Lead assigned to staff

  • lead.status_changed

    Pipeline stage moved

  • lead.converted

    Lead converted to customer

  • lead.lost

    Lead marked as lost

  • lead.note_added

    Internal note added to lead

  • lead.deleted

    Lead removed

Ticket

7 events
  • ticket.created

    Support ticket opened

  • ticket.updated

    Ticket fields changed

  • ticket.reply_added

    New reply posted to ticket

  • ticket.status_changed

    Ticket status changed

  • ticket.assigned

    Ticket assigned to agent

  • ticket.closed

    Ticket resolved and closed

  • ticket.deleted

    Ticket removed

Project

7 events
  • project.created

    New project created

  • project.updated

    Project fields changed

  • project.status_changed

    Project status changed

  • project.milestone_added

    Milestone added

  • project.milestone_completed

    Milestone completed

  • project.finished

    Project marked finished

  • project.deleted

    Project removed

Contract

6 events
  • contract.created

    New contract created

  • contract.updated

    Contract fields changed

  • contract.signed

    Contract signed by client

  • contract.renewed

    Contract renewed

  • contract.expired

    Contract reached end date

  • contract.deleted

    Contract removed

Task

7 events
  • task.created

    New task created

  • task.updated

    Task fields changed

  • task.assigned

    Task assigned to staff

  • task.status_changed

    Task status changed

  • task.completed

    Task completed

  • task.comment_added

    Comment posted on task

  • task.deleted

    Task removed

Estimate & Proposal

9 events
  • estimate.created

    New estimate created

  • estimate.sent

    Estimate emailed to customer

  • estimate.accepted

    Estimate accepted

  • estimate.declined

    Estimate declined

  • estimate.converted

    Estimate converted to invoice

  • proposal.created

    New proposal created

  • proposal.sent

    Proposal emailed to customer

  • proposal.accepted

    Proposal accepted

  • proposal.declined

    Proposal declined

Staff

6 events
  • staff.created

    New staff account added

  • staff.updated

    Staff profile changed

  • staff.role_changed

    Staff role or permissions changed

  • staff.deactivated

    Staff account deactivated

  • staff.deleted

    Staff removed

  • staff.password_changed

    Password reset or changed

Expenses & Payments

6 events
  • expense.created

    New expense logged

  • expense.updated

    Expense fields changed

  • expense.deleted

    Expense removed

  • payment.received

    Payment recorded

  • payment.refunded

    Payment refunded

  • payment.failed

    Payment attempt failed

HMAC-SHA256 signatures

Every webhook request is signed with your per-endpoint secret. Verify in constant time and reject requests that fail the check.

verify-webhook.js
// Node.js — verify the X-PerfexAPI-Signature header
import crypto from 'crypto';

function verifyWebhook(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody, 'utf8')
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex'),
  );
}

// In your Express handler
app.post('/perfex-webhook', (req, res) => {
  const ok = verifyWebhook(
    req.rawBody,
    req.header('X-PerfexAPI-Signature'),
    process.env.PERFEX_WEBHOOK_SECRET,
  );
  if (!ok) return res.status(401).end();
  // ... process req.body.event and req.body.payload
  res.sendStatus(200);
});

PHP and Python equivalents in the docs.

Retries and dead-letter queue

Exponential backoff

Up to 8 retries at 30s, 1m, 5m, 15m, 1h, 6h, 12h, 24h. Any 2xx response is treated as success; 4xx and 5xx trigger the next retry.

Dead-letter queue

Payloads that exhaust their retries are moved to the DLQ and surfaced in the Webhooks admin page. Replay a single delivery or bulk-replay all failures in one click.

100+ events, bundled free.

Themesic's separate Webhooks module ships ~35 events for an additional $59. PerfexAPI bundles everything in the $49 base license — and real-time webhooks beat 15-minute Zapier polling every day of the week.

Frequently asked questions

How do I verify Perfex CRM webhook signatures?

Each webhook request includes an X-PerfexAPI-Signature header with an HMAC-SHA256 of the raw body computed with your per-endpoint secret. Recompute on your side and use a constant-time compare. See the code snippet above.

What is the retry policy for failed webhooks?

Up to 8 retries with exponential backoff (30s, 1m, 5m, 15m, 1h, 6h, 12h, 24h). Exhausted payloads move to the dead-letter queue and can be replayed from the admin page.

What is the difference between Immediate, Smart, and Async modes?

Immediate fires on the request thread for lowest latency. Smart debounces repeated events within 2 seconds. Async queues delivery to a background worker — recommended for production.

Can I use Perfex CRM webhooks with n8n?

Yes. The free n8n-nodes-perfexcrm community node exposes a PerfexCRM Trigger that listens for every supported event and verifies the HMAC signature automatically.

Are webhooks included in the price, or sold separately?

Bundled free with every PerfexAPI license starting at $49. Competitors sell API and Webhooks as separate $59 modules.

Can I rotate the webhook secret without downtime?

Yes. Each endpoint can hold a primary secret and a grace secret for up to 24 hours. New deliveries sign with the primary; your verifier can accept either during the window.

Ready to push signed events into your stack?

Install PerfexAPI, create an endpoint, pick a processing mode, and you are live.

Maintained by Kostas Malakontas at OBS Technologies · Last reviewed