Refresh List webhooks

Send reliable verification updates to your tools when a list finishes or fails. Refresh List sends event metadata only—never email addresses, uploaded files, API keys, or customer credentials.

Quick start

1. Open your workspace and choose Integrations.
2. Enter a descriptive name and an HTTPS webhook URL from Zapier, Make, Pabbly Connect, or your own service.
3. Select the events you want, then choose Create signed webhook.
4. Copy the signing secret immediately. It is displayed once and cannot be recovered later.
5. Send a test list and confirm your automation receives the event before turning on downstream actions.

Events

verification.completed is sent when processing finishes and a report is ready. verification.failed is sent when a job cannot complete and needs attention.

Payload

Requests use POST with Content-Type: application/json. Treat the payload as an event notification and fetch details from the authenticated workspace when needed.

{"id":"evt_123","type":"verification.completed","created":"2026-09-30T12:00:00.000Z","workspace":"workspace_123","job":{"id":"job_123","status":"completed","filename":"campaign.csv","total":10000,"processed":10000}}

Verify the signature

Every delivery includes X-Refresh-List-Signature. Compute the digest over timestamp.payload using the signing secret, then compare it in constant time.

const expected = crypto.createHmac("sha256", secret).update(timestamp + "." + rawBody).digest("hex");

Retries and idempotency

Return a 2xx response only after acceptance. Use the event id as an idempotency key so retries do not create duplicates. For non-2xx responses or timeouts, retry with exponential backoff and inspect the last delivery error in the workspace.

Zapier, Make, and Pabbly

• Zapier: create a Catch Hook trigger and map event fields into the action step.
• Make: add a Custom Webhook module and map the parsed JSON into your scenario.
• Pabbly Connect: choose Webhook/API as the trigger, capture a sample request, and map fields into the workflow.

Keep the signing secret in the platform’s encrypted secret field. Do not put it in a URL, browser code, public template, or shared screenshot.

Security and troubleshooting

• Use HTTPS and validate the timestamp to prevent replay.
• For signature mismatches, verify the raw request body before JSON parsing.
• Deduplicate on event id and return a fast 2xx response.
• Confirm the endpoint is active and subscribed to the matching event.

Need help? Contact Refresh List support.