HTTPS only
The destination must start with https://. Payloads are JSON. Verify deliveries with the X-Kuga-Signature header and the signing secret.
Webhooks
POST signed JSON to an HTTPS endpoint the client already trusts. Webhooks live on the client, next to conversations and Contact Requests. Available on Pro and Advanced.
{
"event_type": "contact_request.created",
"timestamp": "2026-08-31T12:00:00.000Z",
"name": "Alex",
"contact": "alex@example.com",
"message": "Looking for a spring install.",
"attribution": {
"utm_source": "google",
"utm_medium": "cpc",
"utm_campaign": "spring",
"landing_page": "https://client.com/?utm_source=google",
"referrer": "https://www.google.com/"
}
}Events on this client.
Subscribe to what the destination should receive.
contact_request.createdContact request createdWebsite Chat or an AI Form captures a lead.
conversation.endedConversation endedA visitor conversation on this client ends.
funnel.submittedAI Form submittedA public AI Form response is accepted.
handover.requestedHuman handover requestedA customer is waiting for an operator.
handover.acceptedHuman handover acceptedAn operator has taken over.
handover.timed_outHuman handover missedThe conversation moved to contact fallback.
UTM tracking stays on the client.
It is a switch on Website Chat, off until the agency turns it on, and it is included on every plan. When it is on, contact requests, ended conversations, and AI Form submissions can include source, medium, campaign, term, content, click IDs, landing page, and referrer. The same fields stay on the conversation and in exports when no webhook is connected. Handover events leave them out. If the visitor denies analytics cookies, the UTM fields are omitted.
Choose events
Subscribe to contact requests, ended conversations, AI Form submissions, and human handover requested, accepted, or missed.
Keep the CRM
Kuga does not replace HubSpot or Salesforce. A webhook is how those systems stay involved.
Other connections.
Same client workspace.
