Feedback Webhook

We notify you via webhook when a property is accepted or rejected. The webhook is optional: your properties are still published without it, but you won't receive rejection notifications.

---

Endpoint you provide

An HTTP POST endpoint that accepts JSON:

POST https://your-crm.com/api/webhooks/spot2/feedback

It must respond 2xx within 10 seconds.

---

Webhook authentication (HMAC)

So you can verify that requests come from Spot2 and haven't been tampered with, each request includes an X-Signature header with an HMAC-SHA256 of the body.

How it works

1. You give us a shared secret (feedback_secret).

2. Each request we send includes the header:

   X-Signature: sha256=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

3. To verify, your server must:

   • Take the raw request body (bytes, unparsed).
   • Compute HMAC-SHA256 using your secret as the key.
   • Compare the resulting hash (hex, prefixed with sha256=) against the header value.
   • Use timing-safe comparison (constant-time).

If the signature doesn't match, the request is not legitimate. Reject it with 401.

Secret rotation

If you need to rotate the secret, coordinate with us. We can configure a transition window where both secrets (old and new) are accepted to avoid rejections during the change.

---

Retries

If your endpoint doesn't respond 2xx, we retry up to 5 times with backoff:

• Attempt 1: immediate.
• Attempt 2: 10 seconds later.
• Attempt 3: 1 minute later.
• Attempt 4: 5 minutes later.
• Attempt 5: 30 minutes later.

If all 5 attempts fail, delivery is abandoned. It doesn't affect the property's publication.

---

Message language

By default, rejection messages are sent in Spanish. If you need messages in English, we can configure it per platform.

---

Events

We emit two events: item_rejected and item_accepted.

item_rejected

The property was not published. Includes the reasons for rejection.

Payload sent:

{
  "external_id": "prop-12345",
  "status": "REJECTED",
  "messages": [
    "Precio de renta (5000 MXN) por debajo del mínimo (10000 MXN)",
    "La propiedad no tiene fotos"
  ]
}

Field	Type	Description
external_id	string	Your property identifier.
status	string	Always "REJECTED".
messages	string[]	Rejection reasons in natural language.

item_accepted

The property was published successfully on Spot2.

Payload sent:

{
  "external_id": "prop-12346",
  "status": "PROCESSING"
}

Field	Type	Description
external_id	string	Your property identifier.
status	string	"PROCESSING" (Spot2 is processing the publication).

---

Security

• Always use HTTPS.
• Validate the HMAC signature on every request.
• Don't expose the feedback_secret in logs, source code, or URLs.
• If your endpoint is down, webhooks are lost after 5 retries. There is no historical retry queue.