---
slug: webhooks-ausgehend
title: "Can Metrunio notify my system?"
category: installation
locale: en
updated: 2026-10-15
keywords: ["webhook","outgoing","CRM","Zapier","Make","signature","event"]
questions: ["How do I get new orders, refunds and alerts into my CRM by webhook?","Outgoing webhook","Send conversions to my CRM","Report new orders to my own system","Connect Zapier","Connect Make","Verify the webhook signature","Receive events from Metrunio"]
url: https://bench.metrunio.com/en/help/webhooks-ausgehend
---

# Can Metrunio notify my system?

**How do I get new orders, refunds and alerts into my CRM by webhook?**

By webhook, from Growth: under “Data connections → Webhooks” you enter an https address and choose the events. Metrunio calls it for every new order or lead, refund, alert and completed cost sync, signed. It carries no browser or customer identifier, but it does carry the order or lead identifier, value and time, and these can be personal data.

This is the opposite direction to “Can my system report conversions by webhook?”: there your system reports to Metrunio, here Metrunio reports to your system. Webhooks come with Growth and above, together with the read API and MCP.

| Event | When | What it contains |
| --- | --- | --- |
| conversion.created | an order, lead or funnel step has been counted | ID, type, time, website, order or lead ID, value, set value, currency |
| conversion.refunded | a refund has been booked | conversion ID, order number, refunded amount, total of all refunds, status |
| alert.triggered | an alert has fired | kind of alert and its figures |
| cost_sync.completed | a cost sync has taken over figures | platform, period, rows taken over and rows not matched |

```json
{
  "id": "conversion:5f0c…",
  "type": "conversion.created",
  "created_at": "2026-10-10T09:41:00.000Z",
  "data": {
    "conversion_id": "5f0c…",
    "type": "purchase",
    "order_id": "10045",
    "value": 89.9,
    "set_value": 0,
    "currency": "EUR",
    "environment": "production"
  }
}
```

## Verifying the signature

Every delivery carries the x-metrunio-signature header with t=<seconds>,v1=<hex>. v1 is HMAC-SHA256 over "<t>.<raw body>" with your signing secret, built as for incoming requests. Verify the signature on the raw body before processing it, and discard deliveries whose timestamp is older than five minutes.

```javascript
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verify(header, rawBody, secret) {
  const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest();
  const received = Buffer.from(parts.v1 ?? '', 'hex');
  return received.length === expected.length && timingSafeEqual(received, expected);
}
```

The portal shows the signing secret exactly once, when you create the webhook. If it gets lost, renew it with “Renew secret”; the old one stops working.

## Delivery and retries

- A 2xx response counts as delivered. Otherwise Metrunio retries after 1, 5, 15 and 60 minutes, then after 3, 6 and 12 hours; after 24 hours it gives up.
- Every attempt carries the same ID (id in the body, x-metrunio-delivery in the header). Process an event only once.
- Ten seconds per attempt. Metrunio does not follow redirects.
- Only https on port 443. Metrunio cannot reach addresses in your own network (localhost, private addresses).
- “Send test delivery” sends a signed ping event to the address; the log shows the last 50 deliveries.

> **Note:** The payload contains no browser or customer identifier, no click ID and no page address. It does contain the order or lead identifier, value and time, and through them a person can be found in your shop or CRM; treat the deliveries as personal data for that reason. If you need the channel and campaign of an order, ask the read API with the conversion ID.

- Production data only: a live test of your setup does not trigger a webhook.
- At most five webhooks per company.
- The log is kept for 30 days. Metrunio keeps the content of a delivery only until it has been delivered, given up or withheld.
- If you erase the data for an order number under "Privacy" or carry out an objection, Metrunio discards pending deliveries for it, retries included. The same applies when a visitor withdraws consent and the order is deleted as a result. The log then shows the delivery as "not sent (privacy)".
- Before every attempt Metrunio also checks whether the order number has been suppressed or the order deleted in the meantime. If so, nothing goes out.
- Deliveries that had already gone out are recorded when the request is carried out: endpoint, address and time go into the change log entry of the request (180 days) and into the API response. That lets you inform the recipient under Art. 19 GDPR. The delivery log itself is kept for 30 days.
- If your plan drops below Growth, no new deliveries go out; the webhooks stay in place.

Zapier and Make accept webhooks through a module of their own (“Webhooks by Zapier” at Zapier, “Webhooks” at Make). Enter the address it gives you here.

## Also asked

- Outgoing webhook
- Send conversions to my CRM
- Report new orders to my own system
- Connect Zapier
- Connect Make
- Verify the webhook signature
- Receive events from Metrunio

## Related

- https://bench.metrunio.com/en/help/webhooks-conversions
- https://bench.metrunio.com/en/help/server-events-signatur
- https://bench.metrunio.com/en/help/alarme-in-slack-und-teams
- https://bench.metrunio.com/en/help/tarife