Lead webhooks — send leads in and get events out

MJX CRM has two kinds of webhooks. Lead sources are addresses you post leads to. Outgoing webhooks are calls we make to your server when something happens to a lead. This page covers both.

#Part 1 — Lead sources: post leads in

A lead source is a private address made on the Integrations page. The token in the address is the credential, so there is no key and no login. Each source counts its hits and the leads it made.

(For a business the menu says Where leads come from.)

#How to make a lead source

1. Sign in as the Owner or an Admin.
2. In Where leads come from — your sources, pick the kind in the list.
3. Type a name, for example "Website".
4. Press Add source.
5. Press Copy next to the address that appears.

An institute can have up to 20 lead sources. The full address is shown on the source row; it looks like https://pathshala.mjxtechnologies.com/hooks/lead/9f8e… (the token is 40 letters and digits).

#Posting to a generic source ("Any form or tool")

Send POST (or GET with query fields) to the address as:

• JSON (Content-Type: application/json),
• form fields (application/x-www-form-urlencoded), or
• multipart/form-data (FormData). Any file in it is dropped.

A browser on any website may call it — CORS is open for /hooks/lead/ and /hooks/call/, with no cookies. Limits: 256 KB body; for FormData, 80 fields of up to 20 KB each.

fetch("https://pathshala.mjxtechnologies.com/hooks/lead/<token>", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ name: "Meena Iyer", phone: "98XXXXXX32", email: "meena@example.com",
                         message: "Admission for Class 6", source: "website" })
});

curl -X POST "https://pathshala.mjxtechnologies.com/hooks/lead/<token>" \
  -d "full_name=Meena Iyer" -d "mobile=98XXXXXX32" -d "requirement=Admission for Class 6"

Field names do not need to match ours. We read name / full_name / your_name, phone / mobile / whatsapp, email, message / requirement / comments, company, service, budget, city, class / course / grade, booking reference, type, from, to, tags, source, page_url and many other spellings. Nested data, fields, lead or answers objects are opened up. Anything we do not recognise is kept on the lead as Additional details (up to 30 fields). A field named cf_<name> fills that custom field.

A phone number or an email is required.

#Answers from a lead source

Errors use the {"success":false,"error":{"message":"…"}} envelope. The last problem is also shown on the source row as "Last problem: …".

#What the special kinds read

Set-up steps for each are in Lead connectors setup.

#Missed call → lead (/hooks/call/<token>)

Use this as the Answer URL of a Plivo application on your Plivo number. When someone calls:

1. We answer with Plivo XML: the caller hears your greeting (in Indian English) and the call ends.
2. The caller's number becomes a lead (source missed_call), or a note on their existing lead.
3. A high-priority task "Call back … — they called and the line was not answered" is made for the owner (or an admin), due in 30 minutes.
4. The call is logged as an inbound, unanswered call.

The default greeting is "Thank you for calling <your name>. We will call you back shortly." You can change it when adding the source (up to 300 characters).

#Part 2 — Outgoing webhooks: we call your server

When a lead is created or its status changes, we POST to your https:// address. Needs MJX CRM Pro.

#How to add a webhook

1. Type your address in the box (it must start with https://).
2. Tick the events: A new lead arrives (lead.created) and/or A lead's status changes (lead.status_changed).
3. Press Add webhook.
4. Copy the signing secret (whsec_…) — "copy it now; it will not be shown again." Press I have copied it.
5. Press Send a test to send a ping.

Each webhook row has Send a test, Recent calls (the last 20 deliveries), Turn on again (when it is off) and Delete. An institute can have up to 10 webhooks.

#Address rules

• Must be https:// on port 443, with no user name or password in it.
• Must be on the public internet: localhost, .local, .internal, and private, loopback, link-local or cloud-metadata addresses are refused, both when you add it and every time we send.
• Up to 500 characters.

#What we send

POST https://your-erp.example.com/mjx
Content-Type: application/json
User-Agent: MJX-CRM-Webhooks/1
X-MJX-Event: lead.created
X-MJX-Delivery: 7f1c2a9e-3b4d-4c5e-8f6a-1b2c3d4e5f60
X-MJX-Timestamp: 1793162400
X-MJX-Signature: sha256=5d2c…

{
  "event": "lead.created",
  "delivery": "7f1c2a9e-3b4d-4c5e-8f6a-1b2c3d4e5f60",
  "created_at": "2026-10-28T05:30:00.000Z",
  "data": {
    "lead": {
      "id": "3f2b9c1e-6a4d-4f8e-9b7a-2c1d0e5f6a7b",
      "name": "Sunita Sharma",
      "phone": "+9198XXXXXX10",
      "status": "new",
      "tags": [],
      "…": "the full lead object"
    }
  }
}

The lead is the same object as in the API reference.

#Check the signature

The signature is sha256= + the hex HMAC-SHA256 of <X-MJX-Timestamp>.<raw body> using your signing secret. Use the raw body exactly as received.

// Node.js (Express): keep the raw body, e.g. express.json({ verify: (req, res, buf) => { req.rawBody = buf; } })
const crypto = require('crypto');
const expected = 'sha256=' + crypto.createHmac('sha256', process.env.MJX_WEBHOOK_SECRET)
  .update(req.headers['x-mjx-timestamp'] + '.' + req.rawBody).digest('hex');
const got = req.headers['x-mjx-signature'] || '';
const genuine = got.length === expected.length &&
  crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(got));

import hmac, hashlib
expected = "sha256=" + hmac.new(secret.encode(), (timestamp + "." + raw_body).encode(), hashlib.sha256).hexdigest()
genuine = hmac.compare_digest(expected, signature_header)

#Retries and switching off

Calls are sent in the background, so a slow server never slows down the CRM.

#Zapier and Make

• Leads in: use their "Webhooks / HTTP request" step and POST to /api/v1/crm/leads with your API key — or, with no key, to a generic lead source address.
• Leads out: make a "Catch hook" there and paste its https:// address as a webhook here.

#Questions people ask