API and webhooks

What other systems can call, and what the platform calls. There is no public REST API with API keys yet; the endpoints under /api/v1 serve signed-in users of the application (session cookie) and respect their role.

1. Outgoing webhooks (workflows)

A Webhook step in a workflow posts JSON to your HTTPS endpoint.

{
  "event": "workflow.webhook",
  "workflow_id": "…",
  "run_id": "…",
  "step_id": "…",
  "sent_at": "2026-10-18T09:30:00.000Z",
  "contact": { "id": "…", "email": "…", "first_name": "…", "last_name": "…", "tags": [], "lifecycle": "lead", "score": 0, "custom": {} },
  "trigger": { "type": "form_submitted", "data": {} }
}

Headers:

Header	Value
`x-rampline-signature`	`t=<unix seconds>,v1=<hex HMAC SHA-256>`
`x-rampline-delivery`	`<run id>:<step id>`, the same on retries

Verify: compute HMAC SHA-256 over <t>.<raw body> with the workspace's webhook secret (shown in the webhook step) and compare with v1 in constant time. Reject timestamps older than five minutes.

Delivery: 10 seconds timeout, redirects are not followed, any status of 300 or above counts as a failure and is retried with backoff before the step is marked failed. Addresses in private networks are refused in production.

2. Incoming webhooks

Endpoint	Sender	Purpose
`POST /api/webhooks/stripe/<account id>`	Stripe	Checkout completed or expired, refunds, subscription updates, renewals, failed renewals. Signature checked with the signing secret from Settings → Payments; events are stored once and processed by the worker with retries.
`POST /api/webhooks/email/<provider>/<token>`	Resend, Postmark	Bounces and complaints, added to the suppression list. The address with its token is shown in Settings → Email sending.

3. Endpoints for signed-in users

Endpoint	Permission	Returns
`GET /api/v1/contacts/export`	exports, contacts	CSV of all contacts (formula injection neutralised)
`GET /api/v1/contacts/<id>/export`	exports, contacts	One person's records as JSON (access and portability requests), audited
`GET /api/v1/funnels/<id>/export`	funnels	Funnel JSON with its pages and inlined global sections, no contacts
`GET /api/v1/media?kind=image`	funnels	Media library items
`POST /api/v1/media`	funnels (write)	Upload a file (type detected from its bytes, size limited)

4. Public endpoints used by published pages

These serve visitors of published pages and are rate limited per network. The workspace, fields and prices always come from the stored publication, never from the request.

Endpoint	Purpose
`POST /api/public/forms`	Form submission (honeypot field `website`)
`POST /api/public/events`	Page view and timing beacon
`POST /api/public/checkout/quote`	Live totals for the checkout block
`POST /api/public/checkout/start`	Starts a checkout session
`GET /api/public/checkout/return`	Return from the payment page
`POST /api/public/offer`	One-click upsell or downsell
`GET /api/public/order-summary`	Order summary block on thank-you pages

5. Operations endpoints

Endpoint	Purpose
`GET /api/health`	Database, migrations and worker heartbeat; `200` when healthy
`GET /api/tls/ask?domain=`	Asked by Caddy before issuing a certificate: `200` only for verified domains
`GET /api/license/revocations`	The licensor's signed revocation list

6. Not built yet

API keys for outside systems, a documented REST API for contacts, deals and orders, and Zapier-style triggers. Until then, workflow webhooks cover sending data out, and CSV import and export cover bulk transfer.