Один исходящий webhook покрывает любую CRM. Pravia отправляет lead.created в ваш n8n / Make / Zapier / бэкенд — а вы маршрутизируете в AmoCRM, Bitrix24, HubSpot, Pipedrive и др.
Pravia ── lead.created ──► Webhook ──► n8n / Make / Zapier / Backend ──► CRM
{
"event": "lead.created",
"version": "1",
"idempotencyKey": "lead:<uuid>",
"timestamp": "2026-08-18T10:00:00.000Z",
"tenantId": "user_xxx",
"botId": "uuid",
"botName": "Support bot",
"lead": {
"id": "uuid",
"contactName": "Ivan" | null,
"contactInfo": "+7... / email / t.me/...",
"taskDescription": "...",
"siteUrl": "client-site.com" | null,
"status": "new",
"createdAt": "ISO8601"
}
}Подпись считается как HMAC-SHA256(secret, timestamp + "." + rawBody). Проверяйте v1= после t=, используйте timingSafeEqual и окно ±5 мин по X-Pravia-Timestamp — защита от replay.
import { createHmac, timingSafeEqual } from "crypto";
function verifyWithTimestamp(rawBody, signature, timestamp, secret, toleranceSec = 300) {
const now = Math.floor(Date.now() / 1000);
const ts = parseInt(timestamp, 10);
if (Math.abs(now - ts) > toleranceSec) return false; // replay guard
const m = signature.match(/v1=([a-f0-9]+)/i);
if (!m) return false;
const expected = createHmac("sha256", secret).update(timestamp + "." + rawBody, "utf8").digest("hex");
return timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(m[1], "utf8"));
}
// rawBody = exact request body string, not re-stringified JSON
// timestamp = X-Pravia-Timestamp (unix seconds), check ±300s
// version is in payload.version and header X-Pravia-Version: 1
lead.contactName, lead.contactInfo и др.