Bebaak for developers — inbound forms and webhooks

1. Web forms → Connect leads and marketing contacts

Each organisation can make web forms in Connect → Web forms. A form has a public key and works only on the organisation's own websites (its live custom domains plus the websites listed on the form).

Embed (simplest):

<iframe src="https://app.bebaak.co/a/f/<FORM_KEY>" style="width:100%;max-width:520px;height:560px;border:0" title="Enquiry form" loading="lazy"></iframe>

Template downloads and opt-ins (website → CRM contract): open the same form with a source, for example

https://app.bebaak.co/a/f/<FORM_KEY>?source=website-template:rwa-maintenance-ledger

• The source must look like website-template:<slug> (lower-case letters, digits and hyphens; up to 80 characters). Anything else is ignored.
• The form shows a consent box (“Send me e-mails from … I can unsubscribe at any time”). Only a ticked box marks the person as Subscribed (with the wording recorded); otherwise they are captured with consent “Not asked” and get no marketing.
• Every post creates or updates a Connect lead and a marketing contact (de-duplicated on the e-mail), with the source, first / last seen and consent.
• Sequences can start from the source: in Connect → Sequences set “Starts when: Captured from source” and a pattern such as website-template:rwa-* (a trailing * matches the start; separate several patterns with |).
• Slugs that start Bebaak's own ready-made sequences: rwa-* (SocietyOne), dealflow-* or vesting-* (DealFlow), apparel-* (StyleScope).
• Protection: hidden honeypot field, at most 20 posts an hour per visitor per form, origin check against the organisation's websites.

2. Payment gateway webhooks

Shown in Settings → Integrations → (gateway) → Webhook URL, of the form https://<payments host>/pay/hook/<token> — copy it exactly as the app shows it. Bebaak accepts only correctly signed events (Razorpay X-Razorpay-Signature, Stripe Stripe-Signature, Cashfree / PayU hashes, PhonePe X-VERIFY), ignores repeats and answers 200 quickly. See the gateway guides.

3. Courier status webhooks

https://app.bebaak.co/a/hook/ship/<token> — shown on Settings → Integrations → Health & log for each connected courier. Send JSON; Bebaak reads the AWB and the status:

• Shiprocket: awb, current_status (their standard tracking webhook body).
• Delhivery: Shipment.AWB, Shipment.Status.Status.
• Other courier: the fields set in the courier profile (“AWB in the webhook”, “Status in the webhook”).

Statuses are mapped to Booked, Pickup scheduled, In transit, Out for delivery, Delivered, Returned, Cancelled; the raw text is kept in the shipment history. Unknown AWBs are logged and ignored.

4. E-mail provider webhooks (Brevo)

https://app.bebaak.co/a/hook/brevo/<token> (per organisation; Connect → Marketing → Sending & rights). Accepts Brevo transactional events (one object or a list): delivered, opened / unique_opened, click, hard_bounce, soft_bounce, spam, unsubscribed, blocked, invalid_email. Bebaak matches events by its tracking token (X-Mailin-custom) or Brevo's message-id.

Bebaak support live chat: https://app.bebaak.co/a/hook/brevo-chat/<token> (console only).

5. Unsubscribe and tracking links in Bebaak mail

• List-Unsubscribe: <https://app.bebaak.co/a/u/<token>/one> and List-Unsubscribe-Post: List-Unsubscribe=One-Click on every marketing mail (RFC 8058) — a POST unsubscribes at once.
• https://app.bebaak.co/a/u/<token> — the visible unsubscribe page.
• https://app.bebaak.co/a/t/o/<token>.gif (open pixel) and https://app.bebaak.co/a/t/c/<token>?u=…&s=… (click redirect; only links signed for that e-mail are followed).

Rules for every inbound call

• HTTPS only; bodies up to 1 MB; the secret token in the address identifies the organisation — keep it private, and ask Bebaak to rotate it if it leaks (disconnect and reconnect also issues a new one).
• Answers: 200 = accepted (also for repeats), 400 = bad body, 404 = unknown address.
• Personal data received is used only for the organisation that owns the address, under its own consent settings.