Send every lead where you already work

Google Sheets

Connect a Google account and Replavia creates a spreadsheet for your leads, then adds new ones about every 30 minutes. Replavia can only open files it created itself (Google’s drive.file access), so it cannot read the rest of your Drive.

The column order is fixed, so formulas and lookups that point at it keep working. When a person unsends a detail, opts out or asks for deletion, their Name, Email and Phone cells are cleared and the Lead ID stays.

HubSpot

Connect your HubSpot account and new leads are created or updated as contacts about every 30 minutes. A lead with an email address is matched on email, so an existing contact is updated rather than duplicated. A lead without one is matched on its Replavia Lead ID. Empty values are never written over a field you already have.

Replavia creates the five “Replavia” properties in your account on the first sync. If a person unsends a detail, their email and phone are cleared on the HubSpot contact. If they ask for their data to be deleted, the contact is archived.

Webhooks

A webhook sends each lead event to a URL you choose, as an HTTPS POST with a JSON body. Add up to 10 endpoints per workspace, and each one receives every event.

Endpoint requirements

• https:// only, on the standard port 443, with a valid certificate (TLS 1.2 or later).
• The host must resolve to a public internet address. Private and internal addresses are refused.
• Redirects are not followed, so give the final URL.
• Our sending IP address is not fixed. Verify the signature instead of allow-listing an address.

Verification before any lead is sent

When you add an endpoint, Replavia first sends it a webhook.verify event with no lead data in it. Reply with any 2xx status and the endpoint becomes active. Until it does, no lead is sent to it. Your signing secret (whsec_…) is shown once, when you create the endpoint. If you rotate it, the old secret keeps signing alongside the new one for 24 hours so you can switch over without dropping a delivery.

Events

Changes you make yourself in the dashboard, such as a status, a note or a tag, are not sent as events. Read them with the leads API.

Headers

Payload

{
  "version": 1,
  "event": "lead.captured",
  "id": "evt_3xQ9m2KfT7vLp0aZ8nWc4Rj1bYs",
  "occurredAt": "2026-09-13T14:02:51.337Z",
  "data": {
    "id": "cmf1k8z2q0003xyz9abc4def5",
    "username": "jane.bakes",
    "email": "jane@example.com",
    "phone": null,
    "source": "Recipe giveaway",
    "account": "yourbrand",
    "status": "NEW",
    "subscribed": true,
    "note": null,
    "tags": [],
    "capturedAt": "2026-09-13T00:00:00.000Z"
  }
}

occurredAt is the exact moment the change happened. capturedAt is recorded to the day, so its time is always midnight UTC. account is your connected Instagram account, and source is the name of your automation. A lead.deleted event carries no personal data, only the id to match on:

{
  "version": 1,
  "event": "lead.deleted",
  "id": "evt_Vb7Tq1mX0pLs9dK2wZc8Hn4yRa6",
  "occurredAt": "2026-09-14T09:15:03.120Z",
  "data": {
    "id": "cmf1k8z2q0003xyz9abc4def5",
    "reason": "unsend"
  }
}

Verifying the signature

Each request is signed with HMAC-SHA256 using your endpoint’s secret. The signed text is mdf.webhook.v1. followed by the X-MDF-Webhook-Id value, a dot, the timestamp t, a dot, and the raw request body. The signature is base64-encoded. While a secret is being rotated, the header carries two v1= values, so accept the request if either one matches. Always verify against the body bytes exactly as received, because re-serialised JSON will not match. In Node.js:

import { createHmac, timingSafeEqual } from 'node:crypto';

// header   = the X-MDF-Webhook-Signature header
// id       = the X-MDF-Webhook-Id header
// rawBody  = the request body exactly as received (a Buffer, not re-serialised JSON)
// secret   = your endpoint's signing secret (whsec_…)
export function verifyReplavia(header, id, rawBody, secret) {
  if (!header || !id || !secret) return false;
  let ts = null;
  const sigs = [];
  for (const part of header.split(',')) {
    const [k, ...rest] = part.trim().split('=');
    const v = rest.join('='); // base64 can end in '='
    if (k === 't') ts = Number(v);
    else if (k === 'v1' && v) sigs.push(v);
  }
  if (ts === null || sigs.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - ts) > 300) return false; // 5 minutes

  const signed = Buffer.concat([Buffer.from(`mdf.webhook.v1.${id}.${ts}.`, 'utf8'), Buffer.from(rawBody)]);
  const expected = createHmac('sha256', secret).update(signed).digest();
  return sigs.some((s) => {
    const got = Buffer.from(s, 'base64');
    return got.length === expected.length && timingSafeEqual(got, expected);
  });
}

Responses, timeouts and retries

Reply with a 2xx within 10 seconds, and do slow work after you have replied. Delivery is at least once, and the order of events is not guaranteed. De-duplicate on X-MDF-Webhook-Id, and use occurredAt to ignore an update older than one you have already applied.

An event is tried up to 8 times, over up to about 20 hours. The waits between attempts grow from seconds to hours, and each one is randomised so a recovering server is not hit all at once. An endpoint that fails 20 times in a row, over at least 6 hours with no successful delivery in the last 24 hours, is switched off.

Zapier and Make

Zapier and Make connect through their own webhook triggers. There is no listed Replavia app in either directory.

1. Zapier: create a Zap with the “Webhooks by Zapier” app and the Catch Hook trigger, then copy the URL it gives you. Check that your Zapier plan includes Webhooks by Zapier. Make: add the Webhooks module’s Custom webhook trigger and copy its address.
2. In Replavia, open Contacts → Integrations and add that URL as a webhook endpoint.
3. Both reply 2xx automatically, so the verification event activates the endpoint on its own. That first request is the verification event, so map your fields from a real lead.captured event once a lead arrives.
4. Optionally, filter on the event field so each Zap or scenario handles only the events it needs.

Leads API

GET https://app.replavia.com/api/v1/leads returns your leads, newest capture first. Create a key in Contacts → Integrations. It starts with mdf_live_ and is shown once. A workspace can have up to 5 active keys, and you can revoke any of them at any time.

curl "https://app.replavia.com/api/v1/leads?limit=100&status=NEW" \
  -H "Authorization: Bearer mdf_live_…"

Query parameters

Response

{
  "data": [
    {
      "id": "cmf1k8z2q0003xyz9abc4def5",
      "username": "jane.bakes",
      "email": "jane@example.com",
      "phone": null,
      "source": "Recipe giveaway",
      "account": "yourbrand",
      "status": "NEW",
      "subscribed": true,
      "note": null,
      "tags": [],
      "capturedAt": "2026-09-13T00:00:00.000Z",
      "updatedAt": "2026-09-13T14:02:51.337Z"
    }
  ],
  "has_more": true,
  "next_cursor": "Y21mMWs4ejJxMDAwM3h5ejlhYmM0ZGVmNQ"
}

The fields match the webhook payload, plus updatedAt. When has_more is false, you have reached the last page. Leads whose data has been erased are never returned.

Errors and limits