Webhooks: receive matches in your own system

Setup

1. Open Destinations, choose Webhook, and enter your HTTPS URL.
2. Copy the webhook signing secret shown on the same page.
3. Click Send test.

Events

• visitor.identified: a person or company identified on a B2B site. Company matches have data.level = "company".
• shopper.identified: a shopper identified on an ecommerce site.

Verify the signature

Each request has a WhoLayer-Signature header (also sent as X-Wholayer-Signature): the HMAC-SHA256 of the raw request body, using your signing secret, as hex.

import { createHmac, timingSafeEqual } from "node:crypto";

function isFromWhoLayer(rawBody, header, secret) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  return header && expected.length === header.length && timingSafeEqual(Buffer.from(expected), Buffer.from(header));
}

Retries

Respond with any 2xx status within 10 seconds. Failed deliveries are retried with increasing delays for up to 24 hours.

Webhooks also work with Zapier, Make, and n8n: use their "catch webhook" trigger as the URL.