Signals is the inbound door for buying intent you source somewhere else. POST a signed payload from Clay, Common Room, or an in-house scraper and it becomes a buying signal on the company: evidence the engine can cite in a draft, rather than a field sitting inert on a record. Nothing you send here can cause an email to go out.
Worth stating plainly, because an inbound webhook that feeds an outbound system deserves the question. Posting a signal can do exactly four things: record the buying signal, create or fill in the company it belongs to, move a contact watermark (for `champion_moved` only), and queue that company for research, and the last of those only when your organization has explicitly opted that signal type in.
It cannot send an email, approve a draft, or advance a deal. There is no path from this endpoint to the inbox of anyone you sell to, by construction rather than by policy.
Mint a credential at Integrations, then send three headers. The signature is a hex HMAC-SHA256 of the timestamp, a literal dot, and the raw body, keyed by your credential secret. The timestamp binds the signature to a 5-minute window, so a captured request cannot be replayed indefinitely.
POST https://sealdeal.ai/api/webhooks/signals
Content-Type: application/json
x-signal-key-id: <your credential id>
x-signal-timestamp: 1753027200
x-signal-signature: <hex hmac of "${timestamp}.${rawBody}">
{
"signals": [
{
"type": "funding",
"companyDomain": "acme.example",
"summary": "Raised a $40M Series B",
"sourceUrl": "https://example.com/press/acme-series-b",
"occurredAt": "2026-07-28T00:00:00.000Z"
}
]
}This endpoint always fails closed. An unknown or malformed key id, a missing, wrong or stale signature, or a disabled credential all reject the request. There is deliberately no "secret unset, so skip verification" development shortcut, because the credential is per organization and its absence is never ambiguous.
`type` must be one of these. An unrecognised value is rejected with the valid list rather than silently coerced to `other`, so a typo in your integration surfaces immediately instead of quietly filling your pipeline with untyped signals.
120 posts per hour per organization. Batch several signals into one request rather than sending one request per signal: the payload takes an array, and the limit counts requests.
See also: Docs home · Webhooks (outbound) · API reference · API errors · Integrations