Send Kenso events to your systems with webhooks

A webhook sends a Kenso event, such as a reply, a link click or a booked meeting, to a URL you control the moment it happens. Use it to push interested leads into your own systems. Webhooks live in Settings › Webhooks: press G then , to open Settings, then click Webhooks under Integrations.

Before you start

You need to be an admin. Only admins can add, test and delete endpoints. Anyone else gets "You do not have access to manage webhooks."
Your URL must use https and be reachable from the internet. Kenso refuses private, local and internal addresses.
A workspace holds up to 25 endpoints.

Add an endpoint

Open Settings › Webhooks and click Add endpoint at the top right.
Paste your URL into Endpoint URL.
Under Events, click each event you want. reply.received is picked for you.
If a picked event belongs to a campaign, Filters shows a campaign picker. Leave it on All campaigns, or pick up to 10 campaigns so the endpoint only gets their events.
Click Add endpoint, or press ↵. Press Esc to close the form.

Kenso says "Endpoint added" and starts sending matching events right away. The page can't edit an endpoint. To change its URL or events, delete it and add it again.

Which events you can send

Group	Event	Sent when
Accounts and replies	reply.received	A reply arrives, from a campaign or a 1:1 account touch
	meeting.booked	A meeting is booked with an account
	touch.approved, touch.sent	A 1:1 account touch is approved, or sent
	signal.detected	Kenso finds a new signal at an account
	asset.viewed	Someone views a Studio page
	opportunity.created, opportunity.stage_changed	A deal is created, or moves stage, won and lost included
Recruiting events	role_candidate.stage_changed	A candidate moves stage on a role (recruiting workspaces only)
Calls	call.logged	A call is logged with its outcome
Campaign events	email_sent	A sequence email is sent, once per step
	lead_replied	A lead replies to a campaign email
	lead_interested	A reply is classified as interested
	lead_unsubscribed	A lead opts out
	lead_clicked	A lead clicks a tracked link
	reply_opened	A lead opens a reply, first open only
Workflow events	workflow_run_failed, workflow_run_needs_attention, workflow_published, workflow_limit_reached	A workflow run fails or stops for a person, a version is published, or runs pass the workflow's hourly limit

A campaign reply fires both lead_replied and reply.received. Subscribe to one of them, or you get each reply twice.

What a delivery looks like

Kenso sends each event as an HTTPS POST with a JSON body. Every body has eventType, eventId, timestamp and clientId (your workspace). Campaign events add contact, company, campaign, email, reply and click blocks, with null for a block that doesn't apply. Account events add account, person and actor. Each body is capped at 64 KB, and a cut body sets truncated: true on its block.

Ignore keys you don't know: Kenso adds new ones.
Events can arrive out of order and, rarely, more than once. Drop duplicates by eventId or the svix-id header.
Answer with a 2xx status quickly and do the work afterwards.

For a sample body of every event your workspace can use, call GET https://api.ken.so/v1/webhook-event-types with an API key. The Developer docs link on Settings › API keys opens the API reference.

Check that a delivery came from Kenso

Every delivery is signed. It carries three headers: svix-id, svix-timestamp and svix-signature. The signature is an HMAC-SHA256 of {svix-id}.{svix-timestamp}.{raw body}, keyed by the endpoint's signing secret, which starts with whsec_.

The Webhooks page doesn't show the secret yet, so read it from the Kenso API with an admin's API key:

Call GET https://api.ken.so/v1/webhook-endpoints with the header Authorization: Bearer ken_.... Each endpoint's id starts with ep_.
Call GET https://api.ken.so/v1/webhook-endpoints/{id}/signing-secret. Keep the secret on your server, like a password.
In your endpoint, check the signature against the raw request body, not parsed JSON. The open-source svix libraries do this in one call.
Reject a delivery whose svix-timestamp is more than a few minutes old.

If your key reaches more than one workspace, add the X-Ken-Workspace-Id header with the workspace's number.

Send a test

On the endpoint's row, click Send test.
Pick an event type. You can test any type, even one the endpoint doesn't receive.

Kenso sends that event's sample body and shows the answer on the row: "Test delivered just now · 200 OK", "Test failed just now" with the status, or "Test sent just now · waiting for a response" if your endpoint hasn't answered yet.

Watch delivery health

Each row has a dot and a line under the URL, read from the endpoint's latest 10 attempts:

Green and "Delivered" with a time: the newest delivery worked. "No deliveries yet" until the first one.
Failing, with a count such as "3 retries, last 1h ago": the newest attempt failed. Kenso retries failed deliveries with backoff for about a day.
Disabled: Kenso sends nothing to the endpoint.

When an endpoint has failed for 6 hours, Kenso emails the workspace owner and the members who manage integrations, at most once a day. It emails again if the endpoint is disabled after failing. You can't turn these emails off.

Once the endpoint works again, resend what failed in the last 14 days with POST /v1/webhook-endpoints/{id}/recover. The page has no switch to enable a disabled endpoint yet: send PATCH /v1/webhook-endpoints/{id} with {"isDisabled": false}, or delete it and add it again.

Delete an endpoint

Click the trash icon on its row. Kenso says "Endpoint deleted" and stops sending to the URL at once. There is no confirm step and no undo.

Zapier, Make and n8n

To send events to Zapier, Make or n8n, open All integrations, click the app's card and click Connect. Paste the app's catch hook URL into Catch hook URL, pick the events and click Save. The endpoint then shows on Webhooks with the app's name.

What Ken can do here

Press ⌘J and ask Ken which endpoints you have and how their recent deliveries went. With your approval, Ken can add an endpoint, send a test, resend a delivery or delete an endpoint. It needs the same access you do, and it never shows a signing secret.

If something goes wrong

"Use an https URL" The URL must start with https://.
"Pick at least one event" Click at least one event chip.
"URL resolves to a private, loopback, or link-local address." Kenso only sends to public addresses. Use your endpoint's public URL.
"URL host could not be resolved." Check the spelling, or wait for DNS to update.
"This workspace already has 25 webhook endpoints. Delete one before adding another." Delete one you don't use, or send more events to one endpoint.
"The endpoint is disabled. Enable it before sending a test." Enable it with the API, as above, or add it again.
"You do not have access to manage webhooks." Ask an admin to add the endpoint, or to make you an admin.
The signature check fails. Use the raw body, not parsed JSON, and this endpoint's own secret.