Developer documentation for the webhook subsystem of the WPResidence real estate CRM. Lives in libs/webhook-functions.php.

Two Configuration Paths

The plugin supports two configuration styles:

1. Structured config – option wpestate_crm_webhooks, an array of {url, events, active, secret} objects. Read via wpestate_crm_get_webhook_config(), written via wpestate_crm_save_webhook_config().
2. Simple settings – crm_webhook_url + crm_webhook_events (comma-separated). Used by the single-webhook admin UI. Read by wpestate_crm_dispatch_webhook().

Dispatcher

wpestate_crm_dispatch_webhook( $event, $data )

1. Read the webhook URL and event list from settings.
2. Check the event is in the subscribed list (comma-split, trimmed).
3. Build payload: {event, timestamp (ISO 8601), data, site_url}.
4. Compute X-CRM-Signature header if a secret exists: hash_hmac(‘sha256’, $body, $secret).
5. POST via wp_remote_post() with 15-second timeout.
6. On error (WP_Error or HTTP >= 400): schedule single-event cron wpestate_crm_webhook_retry_event in 5 minutes.

12 Subscribable Events

contact.created, contact.updated, contact.deleted, lead.created, lead.updated, lead.deleted, enquiry.created, deal.created, deal.stage_changed, deal.won, deal.lost, task.completed.

Hook Wiring

Hook	Emits
wpestate_crm_after_insert_contact	contact.created
wpestate_crm_after_update_contact	contact.updated
wpestate_crm_after_insert_deal	deal.created
wpestate_crm_after_update_deal	deal.stage_changed, plus deal.won (stage=closed_won) or deal.lost (stage=closed_lost)
wpestate_crm_after_complete_task	task.completed
wpestate_crm_after_record_activity	form_submitted (only for type=form_submission)

Retry Mechanism

Retry handler: wpestate_crm_webhook_retry( $url, $payload, $attempt ), hooked at priority 10 to wpestate_crm_webhook_retry_event with 3 args. Max 3 total attempts. On each retry failure, another 5-minute-delayed cron is scheduled until the attempt count is exhausted.

Test Endpoint

Property	Value
AJAX action	wpestate_crm_test_webhook
Nonce	wpestate_crm_test_webhook (security param)
Capability	manage_options
Input	webhook_url (POST, esc_url_raw)
Payload	event=test, sample contact + listing data
Response	HTTP code + first 200 chars of response body

Security

• HTTPS is not enforced by the plugin. Plain HTTP URLs work. Use HTTPS in production.
• HMAC signing is optional. Enable it by setting a secret in the structured config. The simple settings UI does not expose a secret field.
• There is no IP allowlist. Receiving endpoints should verify the signature.

Error Handling

• is_wp_error() checked on every wp_remote_post() call.
• Response code checked with wp_remote_retrieve_response_code().
• Failures are logged to the plugin’s logs/ directory (not surfaced in the admin UI).

Extending

• Add a new event by calling wpestate_crm_dispatch_webhook(‘my.custom.event’, $data) from a hook in your child plugin.
• Switch to multiple webhooks by using the structured wpestate_crm_webhooks option directly.
• Build a retry queue UI by querying WP-Cron (_get_cron_array()) for pending wpestate_crm_webhook_retry_event entries.