Webhooks
Receive real-time POST notifications for 15 FRITH event types — no polling required.
Configuring a webhook endpoint
- 1Go to Settings → Developer → Webhooks → Add Endpoint.
- 2Enter the HTTPS URL of your server endpoint (must be publicly reachable).
- 3Select which event types to receive (or select All events).
- 4Click Save. FRITH sends a test POST to your endpoint to verify it responds with HTTP 200.
- 5If the test fails, check your server is publicly reachable and responds 200 within 30 seconds.
- 6Once verified, the endpoint is active and starts receiving events immediately.
Signature verification
Every webhook request is signed with HMAC-SHA256 using your webhook secret. Always verify the signature before processing the event:
# Node.js / Express:
const sig = req.headers['x-frith-signature'];
const expected = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET)
.update(req.rawBody).digest('hex');
if (sig !== `sha256=${expected}`) {
return res.status(401).json({ error: 'Invalid signature' });
}
Use the raw request body (before JSON.parse) to compute the HMAC. Parsing first changes the byte representation and invalidates the signature.
Webhook event payload
{
"id": "evt_01j2abc123", // Unique event ID
"event": "invoice.paid", // Event type
"timestamp": "2026-06-11T...", // ISO 8601 UTC
"organisationId": "org_xyz", // Your org ID
"data": { ... } // Resource object
}
Retry policy
If your endpoint returns any status other than 2xx, or times out (30 second limit), FRITH retries with exponential backoff: 5s → 30s → 2min → 10min → 1hr. After 5 failed attempts, the event is marked as failed and you can manually replay it from Settings → Developer → Webhooks → Failed Events.
Events expire after 24 hours — replay before then to avoid losing them.
Event types (15 total)
matter.created— A new matter was openedmatter.updated— Matter fields were changedmatter.closed— A matter was closedcontact.created— A new contact was createdcontact.updated— Contact fields were changedinvoice.created— A new invoice was generatedinvoice.paid— An invoice was marked paidinvoice.overdue— An invoice passed its due date unpaidpayment.received— A payment was recordedtrust.deposit— Trust funds were depositedtrust.withdrawal— Trust funds were withdrawndeadline.due— A deadline is due within the configured lead timetask.completed— A task was marked completelead.created— A new lead entered the pipelinelead.converted— A lead was converted to a client/matter