Connect your Sighthem data to external systems with an open API and webhooks
Sighthem's open API and webhooks connect your foreign trade data to the systems around it, instead of locking it inside one screen. You issue an API key from the panel, read leads, customers, sales orders, shipments and stock over REST, and receive signed webhook events the moment something changes. Reads cover five resources and writes currently focus on lead creation, so you build the integration against a clear, honest boundary.
API keys and authentication: manage access from the panel
Access to the open API starts with a key you generate in the panel. This developer API uses a simple Bearer key, shown in full once, after which Sighthem keeps only its prefix; you separate read and write rights per key.
- Generate the API key from the panel under Settings; the full key appears only once at creation and the system stores the rest irreversibly, minimizing leak risk
- Authenticate every request with a Bearer key in the Authorization header; use a workspace key scoped to the integration rather than a JWT session, keeping it separate from user accounts
- Assign a read or write scope to the key; give a reporting integration read only and close the write surface, applying least privilege
- Each key is bound to a single workspace; preserve tenant isolation so every request sees only its own workspace data, with no cross-workspace access
REST API v1 reads: leads, customers, orders, shipments and stock
The read side exposes the five core resources of the operation as data for external systems. Your own ERP, accounting or BI tool pulls Sighthem data with standard REST API calls, so building a CRM integration API layer needs no separate middleware.
- Read lead and customer records from the /v1/leads and /v1/customers endpoints; move CRM data into your dashboard or data warehouse
- Pull sales orders from the /v1/sales-orders endpoint; combine order status and amount in your own reporting layer
- Fetch shipments from the /v1/shipments endpoint; reflect shipment status in your logistics or customer portal
- Read stock levels from the /v1/inventory endpoint; keep warehouse and availability in sync with external systems, with reads scoped clearly to these five resources
Writes: create leads from an external form with an Idempotency-Key
The write side currently focuses on lead creation. Your website, landing page or external form POSTs a new prospect straight into Sighthem, and repeated submissions do not duplicate the record.
- POST a prospect from your external form or landing page to the /v1/leads endpoint and drop it into the CRM instantly, removing manual copying
- Add an Idempotency-Key header to the request; a network retry or double click does not create the same lead twice, preserving data uniqueness
- Use a separate write-scoped key for writes; give the form integration lead-write rights only and close the other surfaces
- Lead creation is the write endpoint; reads cover five resources while writes are currently limited to leads, so build the integration against this clear boundary
Outbound webhooks: an instant push the moment an event happens
Instead of polling data constantly, webhooks tell your external system when something happens. Sighthem sends an instant HTTP notification to your subscription URL on defined events, so your integration reacts in real time.
- Get notified on the lead created and lead status changed events; reflect a new prospect or a stage change into your external system at once
- Listen to the sales order created and order status changed events; flow the order into your own ERP or production plan automatically
- Bind shipment movement to logistics or customer notifications with the shipment status changed event; stop updating status by hand
- Trigger the COMMERCIAL INVOICE step into your accounting flow with the invoice sent event; the event list is limited to these six events and stays predictable
Signed, secure delivery: HMAC signatures and retries
The receiving system needs to verify that each notification truly comes from Sighthem. Sighthem signs every request, retries failed deliveries with exponential backoff and only sends to safe destinations.
- Send every notification with an HMAC-SHA256 signature in the x-sighthem-signature header; the receiver recomputes the signature from the timestamp and body to confirm the request is authentic
- On a failed delivery, exponential backoff retry kicks in; a temporary outage does not lose the notification, and it is resent for up to eight attempts
- Notifications go only to an https address; IP literals, localhost and internal domains are rejected, so SSRF protection keeps internal services out of reach
- Keep every request traceable with signature, timestamp and delivery-id headers; filter out replay attacks and forged calls on the receiving side
Panel management: keys, subscriptions, delivery history and testing
You manage the integration from the panel, not buried in code. The API screen under Settings gathers keys, webhook subscriptions, delivery history and test sends in one place.
- Generate, name and deactivate API keys from the panel; disable a leaked or unused key in one click
- Define the webhook subscription from the panel; pick the target URL and the events you want to listen to, and change the subscription without touching code
- Watch delivery history from the panel; see which notification was sent, retried or failed, making integration issues visible
- Verify a subscription with a test send before binding it to a live event; see that the receiving end handles the signature correctly before going to production
Integration scenarios: connect Sighthem data to your own stack
Open API and webhooks put Sighthem at the center of your foreign trade stack. Systems like accounting, e-invoicing, a data warehouse and external forms share the same CRM and ERP data with no double entry.
- Connect your accounting or bookkeeping software to the order and customer read endpoints; keep billable data in sync without manual transfer
- Bind your e-invoice or integrator flow to the invoice sent event; automate the COMMERCIAL INVOICE trigger in your own system
- Connect your website contact form to the lead write endpoint; drop every inquiry straight into the CRM without moving it by hand
- Feed your data warehouse or BI dashboard from the read endpoints; keep shipment and stock status near real time in your own reporting layer
Build the integration with least privilege. Give the reporting and data-warehouse side a read-scoped key only, and open writes only to the form integration that creates leads. That way, even if a key leaks, its blast radius stays small and you separate the read and write surfaces from the start.
When you build on events instead of polling, the external system does not have to scan for data every minute; a notification arrives when something happens. Once lead, order and shipment status changes flow out instantly, the lag between two systems drops from hours to seconds and manual copying disappears.
Do not process an incoming webhook without verifying its signature. If you do not recompute the x-sighthem-signature header from the timestamp and body and compare it, a forged call could inject data into your system. Signature verification, the https requirement and a replay window check are the receiver's responsibility, so do not skip them.
Frequently Asked Questions
What data does the open API reach, and where are reads and writes limited?
The read side covers five resources: leads, customers, sales orders, shipments and stock, which you pull from the /v1/leads, /v1/customers, /v1/sales-orders, /v1/shipments and /v1/inventory endpoints respectively. The write side currently focuses on lead creation; you POST a prospect from an external form to the /v1/leads endpoint. The scope is deliberately clear, so you build the integration against these boundaries.
How do I generate an API key, and what happens if I lose it?
You generate the key from the API screen under Settings in the panel. The full key appears only once at creation; the system stores the rest irreversibly, so you need to save the key somewhere safe. If you lose or leak the key, you deactivate it from the panel and generate a new one, and the old key becomes invalid at once.
On which events does the webhook trigger?
Six events are defined: lead created, lead status changed, sales order created, order status changed, shipment status changed and invoice sent. When you subscribe to one of these, an instant HTTP notification goes to the URL you set the moment the event happens. The event list is limited to these six, so you plan the integration against this clear scope.
How do I verify that an incoming webhook truly came from Sighthem?
Every notification arrives with an HMAC-SHA256 signature in the x-sighthem-signature header. Your receiving system recomputes the same signature from the timestamp and request body using the shared secret and compares it with the header value; if they do not match, you reject the request. Notifications go only to an https address and SSRF protection keeps internal services out of reach, so both the direction and the content stay secure.
If a delivery fails, is the notification lost?
No. A failed delivery goes into exponential backoff retry and is resent for up to eight attempts, so if your receiving end is briefly unreachable the notification does not drop immediately. You see the delivery history in the panel and track which notification was sent or retried, and you verify a subscription with a test send before taking it to production.
Manage API keys, REST read endpoints, lead writes and signed webhook events on the same platform as the rest of your foreign trade. Try Sighthem free for 14 days on the PRO plan, no card required.
Start a 14-day PRO trial · Foreign trade software · Export CRM · See pricing