Lead Webhook API
Send leads from any source — website forms, landing pages, Zapier, Make, or your own backend — directly into Rise CRM in real time.
How to get your API key: Sign in to Rise CRM → Settings → API & Webhooks → Generate API Key. The key is shown exactly once — store it securely.
How it works
1A user submits a form on your website or landing page
2Your server (or Zapier/Make) sends a
POST request to /leadWebhook3Rise validates your API key and saves the lead to your pipeline
4The lead appears instantly in Rise CRM with a push notification
Authentication
All requests must include your Rise API key in the Authorization header using the Bearer scheme.
Authorization: Bearer rise_a1b2c3d4e5f6...
Keep your API key secret. Never expose it in client-side JavaScript, public repositories, or URLs. Always call this endpoint from a server or trusted backend.
Key format
Rise API keys always start with rise_ followed by 64 hex characters. Example:
rise_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6ab
Quick Start
Replace YOUR_API_KEY with your key and run this in your terminal:
curl -X POST https://asia-south1-rise-crm-1509.cloudfunctions.net/leadWebhook \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "Rahul Sharma", "phone": "+919876543210", "email": "rahul@example.com", "source": "Website Contact Form", "formName": "Homepage" }'
A successful response is
HTTP 201 with {"ok": true, "leadId": "wh_..."}. The lead appears in Rise CRM within seconds.POST /leadWebhook
POST
https://asia-south1-rise-crm-1509.cloudfunctions.net/leadWebhook
Creates a new lead in your Rise CRM pipeline. The lead appears immediately with a push notification. Requires a valid API key in the
Authorization header.Request Body
Send Content-Type: application/json. At least one of name, phone, or email is required.
| Field | Type | Status | Description |
|---|---|---|---|
name |
string | required* | Full name of the lead. Stored exactly as provided. |
phone |
string | required* | Phone number. E.164 format recommended (e.g. +919876543210) for WhatsApp dialling and deduplication. |
email |
string | required* | Email address. Used alongside phone for duplicate detection. |
source |
string | optional | Where this lead came from. Displayed exactly as-is in Rise (e.g. "Website Contact Form", "Landing Page"). Defaults to "Website". |
formName |
string | optional | The specific form name (e.g. "Homepage Hero Form"). Shown in lead detail view. Defaults to "Website Form". |
fields |
object | optional | Any extra key-value pairs as strings. Shown in the lead detail panel. Example: {"city": "Mumbai", "budget": "50000"} |
* At least one of name, phone, or email must be provided. All three is strongly recommended.
Example request body
{
"name": "Priya Mehta",
"phone": "+918888888888",
"email": "priya@example.com",
"source": "Homepage Contact Form",
"formName": "Contact Us",
"fields": {
"city": "Mumbai",
"budget": "50000",
"message": "I am interested in your services."
}
}
Responses & Errors
201 Created Lead saved successfully
{
"ok": true,
"leadId": "wh_1693567890123_a4b5c6",
"isDuplicate": false,
"duplicateOf": null
}201 Created (Duplicate) Saved but flagged as a duplicate
{
"ok": true,
"leadId": "wh_1693567999999_d7e8f9",
"isDuplicate": true,
"duplicateOf": "wh_1693000000000_a1b2c3"
}401 Unauthorized
{ "error": "Invalid API key." }400 Bad Request
{ "error": "At least one of 'name', 'phone', or 'email' is required." }Error code reference
| HTTP Status | Meaning | Action |
|---|---|---|
| 201 | Lead created | Nothing — you're good. |
| 400 | Missing required fields | Ensure at least one of name, phone, email is non-empty. |
| 401 | Invalid or missing API key | Check your Authorization: Bearer rise_... header. Regenerate key in Rise Settings if needed. |
| 405 | Method not allowed | Use POST — not GET, PUT, or PATCH. |
| 500 | Internal server error | Retry with exponential backoff. Contact Rise support if persistent. |
Duplicate Detection
Rise checks if an incoming lead shares the same phone or email as any lead already in your pipeline.
- If a match is found, the new lead is still created — it is not rejected.
- It is flagged with
_isDuplicate: truein Firestore. - In Rise CRM, duplicate leads show an amber "Duplicate" badge on the card and a warning in the detail panel.
- The API response returns
isDuplicate: trueandduplicateOf: "<original-lead-id>".
Duplicate detection uses exact string comparison of phone and email. Normalising phone numbers to E.164 format (
+91XXXXXXXXXX) before sending is recommended for reliable deduplication.Rate Limits
The following limits are enforced by the API:
| Limit | Value |
|---|---|
| Max payload size | 1 MB |
Max source / formName length | 200 characters (truncated automatically) |
| Concurrent requests | Subject to Firebase Cloud Functions default quotas |
No custom per-key rate limiting is currently enforced beyond Firebase's platform quotas. For high-volume integrations (>100 leads/min), contact Rise support.
Code Examples
curl -X POST \ https://asia-south1-rise-crm-1509.cloudfunctions.net/leadWebhook \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "Priya Mehta", "phone": "+918888888888", "email": "priya@example.com", "source": "Homepage Contact Form", "formName": "Contact Us", "fields": { "city": "Mumbai", "message": "I am interested in your service." } }'
// Node.js 18+ or modern browser const response = await fetch( "https://asia-south1-rise-crm-1509.cloudfunctions.net/leadWebhook", { method: "POST", headers: { "Authorization": `Bearer ${process.env.RISE_API_KEY}`, "Content-Type": "application/json", }, body: JSON.stringify({ name: "Priya Mehta", phone: "+918888888888", email: "priya@example.com", source: "Homepage Contact Form", formName: "Contact Us", fields: { city: "Mumbai", message: "I am interested in your service.", }, }), } ); const data = await response.json(); if (response.ok) { console.log("Lead created:", data.leadId); if (data.isDuplicate) console.warn("⚠ Duplicate detected"); } else { console.error("Error:", data.error); }
<?php $apiKey = getenv('RISE_API_KEY'); $payload = json_encode([ 'name' => 'Priya Mehta', 'phone' => '+918888888888', 'email' => 'priya@example.com', 'source' => 'Homepage Contact Form', 'formName' => 'Contact Us', 'fields' => ['city' => 'Mumbai'], ]); $ch = curl_init('https://asia-south1-rise-crm-1509.cloudfunctions.net/leadWebhook'); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $payload, CURLOPT_HTTPHEADER => [ 'Authorization: Bearer ' . $apiKey, 'Content-Type: application/json', ], ]); $body = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); $data = json_decode($body, true); if ($httpCode === 201) { echo "Lead created: " . $data['leadId']; } else { error_log("Rise error: " . ($data['error'] ?? $httpCode)); }
import os, requests WEBHOOK_URL = "https://asia-south1-rise-crm-1509.cloudfunctions.net/leadWebhook" resp = requests.post( WEBHOOK_URL, json={ "name": "Priya Mehta", "phone": "+918888888888", "email": "priya@example.com", "source": "Homepage Contact Form", "formName": "Contact Us", "fields": {"city": "Mumbai"}, }, headers={"Authorization": f"Bearer {os.environ['RISE_API_KEY']}"}, timeout=10, ) data = resp.json() if resp.status_code == 201: print(f"Lead created: {data['leadId']}") if data.get("isDuplicate"): print("Warning: duplicate lead detected") else: print(f"Error {resp.status_code}: {data.get('error')}")