Skip to main content

Webhooks

Webhooks move data in both directions: you can send leads into a Syft motion, and Syft can deliver motion results to your own endpoint.

Inbound trigger URLs​

A motion with the Webhook trigger has its own URL. Send a lead to it and the motion runs for that lead. You'll find the URL, and an example request, in the motion's trigger settings.

POST https://app.syftdata.com/api/webhook/motion/{motionId}

Pass your server secret key in the Authorization header:

Authorization: Bearer sk_live_...

The JSON body describes the lead. At least email or linkedin is required. You can also send name, firstName, lastName, title, company, phone and website. These optional fields are stored as contact properties.

curl -X POST "https://app.syftdata.com/api/webhook/motion/{motionId}" \
  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "lead@example.com",
    "firstName": "Jane",
    "lastName": "Doe",
    "title": "VP of Marketing",
    "company": "Acme Inc"
  }'

A successful request returns 202 { "success": true, "message": "Lead enqueued for processing" }. The lead is processed in the background. See Errors for the shared error responses. An inbound URL also returns 400 when the motion is a draft or disabled, and 404 { "error": "Motion not found" } when the motion doesn't exist or belongs to another workspace.

Outbound deliveries​

Syft can push account and lead data from a motion to any webhook endpoint you own. See Webhook for how to set it up and for the payload fields.

IP Allowlist​

If your firewall or API gateway only accepts traffic from known addresses, add Syft's outbound IP addresses to your allowlist.

Syft's IP addresses​

34.150.178.103/32
8.234.226.21/32
34.11.108.253/32
34.21.19.22/32
  • Add all four. A request can come from any of them, and which one is used can change at any time.
  • Each entry is a single address (/32), not a range. If your tool doesn't accept /32, enter the plain IP.
  • These addresses are reserved for Syft. We'll give advance notice before changing them.

This list is for traffic from Syft to you. You don't need it to call Syft's APIs, such as the Lookup API or Export API.

What comes from these addresses​

Requests from Syft's background processing, including:

  • Motion deliveries to your webhook endpoints
  • Motion actions sent to a self-hosted PostHog instance
  • Checks that the Syft tag is installed on your website

What doesn't​

  • The Test button in webhook setup doesn't use these addresses, so a test can fail even when real deliveries work.
  • A couple of edge cases also don't use these addresses.

If you see failures after adding these addresses to your allowlist, reach out to support@syftdata.com.