POST /api/v1/ingest/:slug
HMAC-signed lead submission, keyed by form slug. See the signed webhooks guide for a walkthrough and worked examples.
Request
POST https://app.blackglassleads.com/api/v1/ingest/:slug
:slug is the form's slug (Settings → Forms → form → Delivery).
| Header | Required | Value |
|---|---|---|
X-BGL-Timestamp | Yes | Unix seconds; within ±5 minutes of server time |
X-BGL-Signature | Yes | Hex HMAC-SHA256(secret, "{timestamp}.{rawBody}"). Optional sha256= prefix accepted. |
Content-Type | Yes | application/json |
X-BGL-Idempotency-Key | No | 1–255 char string; dedups retries for 24h |
Body — arbitrary flat JSON object, max 128 KB.
A form with no webhook secret configured rejects every request — signing is mandatory on this surface, not optional.
Response
| Status | Body | Meaning |
|---|---|---|
202 | { "submission_id": "<uuid>" } | Accepted and scored. |
200 | { "status": "rejected" } | Opaque rejection — see Headers, errors & limits. |
A 200 { "status": "rejected" } covers: form not found/inactive/ambiguous slug, suspended workspace, no webhook secret configured, missing or invalid timestamp, timestamp outside the ±5 minute window, missing or malformed signature, signature mismatch, rate limit exceeded, malformed idempotency key, and oversized body.
Rate limits
Per workspace: 1,000/minute, 50,000/day — tracked separately from Surface 1a's buckets. See Headers, errors & limits.
Idempotency
Same 24-hour dedup semantics as POST /api/v1/ingest.