What Are Webhooks?
Understand what SMLLR's outbound webhooks do, what's in the payload, and how they relate to the REST API and MCP server.
What Webhooks Do
A webhook is the reverse of the REST API: instead of you asking SMLLR for data on a schedule, SMLLR sends data to a URL you control the moment something happens. Register an HTTPS endpoint under Settings → Webhooks & Slack, and SMLLR POSTs a signed JSON payload to it every time a subscribed event happens on your account.
This is what makes real-time reactions possible — trigger an internal notification, log the event into your own system, or kick off a workflow the instant it happens, without polling the REST API on a timer. The same endpoints power Slack notifications and Zapier automations — see the Slack Integration and Using Zapier articles.
Webhooks vs. the REST API and MCP Server
All three share the same discipline: aggregated scan/campaign/client analytics only, never Lead Hub contact data.
| REST API / MCP Server | Webhooks | |
|---|---|---|
Direction | Pull — you ask, SMLLR answers | Push — SMLLR sends, you receive |
Latency | As fresh as your last poll | Real-time, as the event happens |
Scope | Read-only, all analytics endpoints | 6 event types — QR lifecycle, scans, and redirect rules |
Plan | Premium | Pro and above |
Available Event Types
Each endpoint picks which events it wants when you create it, in Settings → Webhooks & Slack. New endpoints default to everything except the two "fires on every matching scan" events — opt in to those explicitly if you want them.
| Event | Fires When |
|---|---|
scan.created | A QR code is scanned |
qr.created | A new QR code is saved |
qr.updated | An existing QR code is edited |
qr.scan_limit_reached | A QR's scan-limit redirect (Basic+) crosses into its fallback URL — fires once, not on every scan after |
qr.scheduled_redirect_fired | A scheduled redirect rule (Pro+) matches a scan — fires on every matching scan |
qr.device_redirect_matched | A device-based redirect rule (Basic+/Pro+) matches a scan — fires on every matching scan |
What's in the Payload
Every payload shares the same envelope — event, timestamp, and a data object — but the fields inside data differ by event type. The scan.created shape:
Never included, in any event type: IP address, precise GPS coordinates, fraud-detection signals, or anything from Lead Hub (name, email, phone, consent). This is by design, not a configuration option.
| Field | Description |
|---|---|
event | The event type, e.g. |
timestamp | When SMLLR sent the delivery, ISO 8601 |
data.qrCodeId / qrCodeName | Which QR code was involved |
data.campaignId | The QR's campaign, if any |
data.scanId / scannedAt | Unique scan identifier and when it happened (scan/redirect-rule events only) |
data.device / os / browser | Scanner's device type, OS, and browser (scan.created only) |
data.country / region / city | Coarse location, same as the dashboard's geo breakdown (scan.created only) |
data.targetUrl | Where the scan was (or would be) redirected to |
Account-Wide Delivery (No Per-QR Scoping Yet)
Every enabled endpoint fires on every matching event across the account — there's no way to scope an endpoint to a specific QR code or campaign in this version. Up to 10 endpoints are allowed per account, generic and Slack combined.
Which Plans Include Webhooks?
Webhooks, Slack notifications, and Zapier are all available on the Pro plan and above.
Was this article helpful?