A lead generation API with signed webhooks and HubSpot sync

What the lead generation API covers

The API lives at /api/v1 and speaks JSON. You send your key as a Bearer token, and unknown fields in a request body are rejected, so a typo fails loudly. The 15 endpoint paths:

Four rules apply to every call:

• No duplicates. Creating a company that already exists merges into it, and fields already set win until you send a PATCH.
• Same checks as the app. Enrolling goes through suppression, country and lawful-basis rules, email status and daily limits. Because an API call is automatic rather than a person picking contacts one by one, it also skips contacts marked not interested, customer or meeting booked, and anyone contacted in the last 7 days.
• Approval still applies. Sending follows the sequence's approval settings, whoever enrolled the contact.
• Discovery is metered the same way. A discovery run started over the API counts against the same workspace run limits as one started in the app, and its results stay staged until someone accepts them there.

API keys, scopes and rate limits

There are three kinds of key:

• Full access reaches every endpoint.
• Read only can use GET endpoints and nothing else, which makes it the right choice for dashboards and assistants.
• Chrome extension reaches only the extension endpoints, not this API.

For example, give a reporting dashboard a read only key and keep a full access key for the script that creates companies.

FoxKnock stores only a hash of each key (plus a short prefix so you can recognize it in the list), and you can have up to 25 active keys. A key acts with the access of the person who created it and stops working when that person leaves the workspace.

Each key gets 120 requests a minute, with tighter limits on two endpoints: POST /companies at 60 a minute and POST /discovery/runs at 10. Errors share one shape, with a code and a message. Two status codes need handling:

• 402 means you are out of credits or at the monthly spend cap you set in Billing. The cap applies to API calls too: a call that would take spend past it gets a 402.
• 429 means a rate limit, the daily AI budget or the discovery quota.

Cold email webhooks: 13 signed events

Webhooks push an event to your server when something happens. Subscribe to specific events or to all of them.

Three details about the events:

• reply.interested fires for a confident hot reply: interested, a meeting request or a question, using the labels from the AI inbox.
• meeting.booked fires when a person marks a meeting as booked on a reply, because there is no calendar integration.
• There are no open or click events, because FoxKnock does not track opens or clicks.

How delivery works

• Signature. Every delivery carries an X-FoxKnock-Signature header: sha256= followed by the HMAC-SHA256 of the raw request body, made with the signing secret. The secret is shown once, when you create the webhook, and you can rotate it later.
• Answer fast. Your endpoint has 10 seconds to answer with a 2xx, and redirects are not followed.
• Retries. A failed delivery is retried with back-off, up to 5 retries over roughly 15 minutes. A webhook that fails every delivery for 3 days is switched off and you are notified.
• Dedupe. Delivery is at least once, and the order of events is not guaranteed. Delivery ids stay the same across retries, so use them to skip repeats.
• Limits. URLs must be public https addresses, and you can have up to 20 webhooks.

An illustration with a fictional 3-person agency: it sends reply.interested to an n8n workflow that posts the reply summary into its chat tool and creates a task in its project tracker.

HubSpot sync, Slack alerts and automation tools

HubSpot

HubSpot is a one-way push from FoxKnock, using a private-app token. It does four things:

• Creates or updates companies (matched by domain) and contacts (matched by email) with the enriched fields FoxKnock holds, such as titles, locations and employee count.
• Adds a note for each real reply, with the classification and the start of the reply text.
• Opens a deal for interested or meeting-booked contacts (deals need the deals scope on your token).
• Runs every 15 minutes after the first sync, or on demand with Sync now.

Fit scores and research dossiers are not pushed. Demo records are never pushed, and edits made in HubSpot do not flow back.

Slack

Slack alerts use an incoming-webhook URL, not a Slack app install, and cover hot replies, visitors, forms, plays and meetings.

Zapier, Make and n8n

Zapier, Make and n8n have no dedicated FoxKnock app. Each has a way to start a workflow from an incoming webhook (a Catch Hook trigger in Zapier, a Custom webhook module in Make, a Webhook node in n8n) and a way to call an HTTP API, so they connect through your webhooks and the REST API.

Check your plan before you build on it. Webhooks by Zapier, which provides the Catch Hook trigger, is a premium app, and Zapier's help center says premium apps need a paid plan or the free trial (as of October 2026).

Chrome extension

The Chrome extension (a developer-mode install today) shows what your workspace already knows about the company site you are on (fit, research summary, cited facts, a suggested opener) and saves a company or person in two clicks. It reads only the address and title of the active tab, and only when you click its icon.

Connect Claude to your CRM data

You can do this today, without waiting for an MCP server. Create a read-only key, then give Claude a tool that calls the GET endpoints for companies, contacts, signals, replies and research.

With the Claude API, you define a tool with a name and a schema, Claude asks for a call, and your code runs it and returns the result, as the tool use documentation describes. A read-only key can only use GET endpoints, so a wrong tool call cannot edit or enroll your leads. A native MCP server is coming soon.

Anything the assistant reads goes to the model provider you connect it to, so pick a provider you are comfortable with. To simply ask questions about your own workspace, use Ask FoxKnock inside the app: the chat itself uses no credits, and daily message limits apply.

What the API costs and where it stops

Reading and writing your own records does not spend credits. Work done for you does, at the same default prices as in the app:

• A research report is charged when it completes.
• A discovery result is charged when you accept it.
• An AI-written email is charged when it is drafted.

Credits are charged the same if you use your own provider keys. Plans start at Free ($0, 500 one-time credits), and Growth is $149 a month with 20,000 credits. The pricing page lists current credit prices and shows REST API keys and CRM sync as Growth plan features.

The API suits you if you would otherwise chain CSV exports and one-off scripts: research reports come back with their evidence cards and source URLs, as in cited research. It does not suit you if you need two-way CRM sync, a CRM other than HubSpot or a native MCP server today, because FoxKnock does not offer them.

To see the data the API returns on your own market, start free and run discovery and research in the app with your free credits.