Integrations and webhooks

Owners and admins connect Slack, Microsoft Teams and import sources and manage webhooks; tenant:read sees them. Tokens and secrets are never returned: a webhook's signing secret is in the answer that makes or replaces it, and nowhere else.

Importing into Tasks

Connect a source with a token made there: a Jira Cloud API token (with your site and the account's email), a Linear API key, a GitHub fine-grained token with read access to Issues and Metadata, a GitLab token with read_api (and your host, for a self-managed GitLab), or a Zendesk API token (with your <name>.zendesk.com site and the agent's email; its projects are groups, or all). GET …/integrations/sources/:provider/projects lists what it reads; POST …/integrations/imports imports one into a Tasks space you administer, in the background, as you.

Types, statuses, priorities, labels, people (matched by email), parents and comments come across, and each issue links back to its source. Importing the same project into the same space again brings only what's new. Follow progress with GET …/integrations/imports/:importId, or from MCP with issues_imports_list.

Importing into Customers

Connect Stripe with a restricted key that reads Customers, Subscriptions, Invoices and Products (a secret key is refused), HubSpot with a private app's access token (crm.objects.companies.read, crm.objects.contacts.read, crm.objects.deals.read, crm.objects.owners.read), or Salesforce through its sign-in (POST …/integrations/salesforce/authorize, then the browser comes back through Tenant). POST /v1/orgs/:orgId/crm/source-imports with provider and, optionally, objects starts an import as you; follow it with GET …/crm/source-imports/:importId, or from MCP with crm_imports_list.

Stripe's customers become accounts with a contact, and their subscriptions and invoices activities on both; HubSpot's companies, contacts and deals and Salesforce's accounts, contacts, leads and opportunities become their namesakes. Each record's description ends with a link back. Matches already here (accounts by name, contacts and leads by email) are linked rather than copied. Running an import again changes a field only where the source changed it and nobody here did since.

Webhooks

Webhook events are your organization's audit actions (member.join), whole categories (member.*) or *. Each delivery is a JSON POST with x-cactive-event, x-cactive-delivery (the same on every retry) and x-cactive-signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">. A failed delivery is tried again after 1, 5 and 30 minutes and two hours; a 4xx other than 408 or 429 isn't retried.

Every route below, with its parameters, request and response, errors and samples, is in the API reference.