Přejít na obsah
Peak Atlas

Peak Forms · Developers

Process responses
via webhook.

Peak One sends every submission as signed JSON to your server. You verify the signature, detect duplicates by ID and process the rest as usual. You create forms themselves as drafts through the agent API; they only go live after your approval.

Start for free

HMAC-SHA256, timestamp and event ID in every delivery.

Peak FormsYour answer
HubSpotThe matching field
HubSpot · CRM adapter
One mapping in detail
01 / Peak FormsEmail
02 / Fictional test valuedemo@example.com
03 / HubSpotemail

A readable field path from the adapter. No transfer, no verified delivery.

View all 5 mappings
Field mapping from the existing adapter. Fictional values, no delivery.
Peak FormsHubSpot property
Emailemail
First namefirstname
Last namelastname
Lifecycle stagelifecyclestage
Lead statushs_lead_status
Code present
Delivery unverified
The connection is set up in the real product. No OAuth happens here.
One concrete target

Understand fields. Check access.

HubSpotReceipt in the target accountNot checked yet

A mapping shows the translation. Only a test in the authorised account shows that data arrived.

02 / How to start

From endpoint to first delivery.

The body always has the same envelope. Under data you find lead, answers, source and campaign.

  1. 01 / Endpoint

    Create an endpoint

    Enter a public https address. Internal addresses and IP ranges are refused.

    Public https addresses only.POST to your addressInternal addresses refusedIP ranges refused
  2. 02 / Secret

    Store the secret

    Peak One creates a secret with the prefix whsec_. Keep it server-side.

    whsec_ stays on your server.Peak-Signaturet=<time>,v1=<HMAC-SHA256>Peak-Webhook-Timestamp
  3. 03 / Test

    Send a test

    “Send test” delivers a sample event. Check signature and duplicate detection.

    A delivery with test: true.Verify the signatureKeep the Peak-Webhook-IdDetect duplicates

Trust needs clarity

What you get today, and what you don't.

01 / The existing evidence

Signed in every delivery

HMAC-SHA256, timestamp and event ID in every delivery. On a retry the event ID stays the same.

Adapter / ReceiptDELIVERY OPEN
Peak FormsField mappingHubSpot
Adapter in source code
Present
Receipt in the target account
Not checked

02 / Your check

Your check

“Send test” delivers a sample event. Check signature and duplicate detection before real responses flow.

Account
Not connected
Permission
Grant in the product

03 / The clear limit

Not available yet

The agent API creates and changes drafts and requests publishing, which a person approves. There is no API to fetch all responses, no SDK and no published command-line tool yet. You get responses by webhook and CSV export, a single response only with its own read permission.

  • Adapter
  • Webhook
  • Embed
  • Planned

The next step

Build on real events.

Create a free account and send yourself the first test event.

Start for free
Your field translationNOT CONNECTED
Peak Forms→HubSpot
Email → email

Check in the target account what actually arrived.

Sample code

Verify the signature and embed.

The signed text is “<timestamp>.<raw body>” with your webhook secret. Verify on the raw body before you parse it.

Verify the signature (Node.js)
import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyPeakWebhook(secret, rawBody, header, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=", 2)));
  const t = Number(parts.t);
  if (!t || !parts.v1 || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const want = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest();
  const got = Buffer.from(parts.v1, "hex");
  return want.length === got.length && timingSafeEqual(want, got);
}
Embed a form
<iframe src="https://app.peak-atlas.com/f/<public-id>?embed=1"
  title="Kontakt" loading="lazy"
  style="width:100%;min-height:640px;border:0"
  data-peak-form="<public-id>"></iframe>
Create a form draft through the agent API
curl -X POST https://app.peak-atlas.com/api/v1/actions/form.create_draft \
  -H "Authorization: Bearer $PEAK_AGENT_TOKEN" \
  -H "content-type: application/json" \
  -H "Idempotency-Key: form-erstgespraech-01" \
  -d '{"template_id":"lead"}'

# 200 {"status":"ok","data":{...},"object":{"type":"form","id":"...","url":"..."}}
Request publishing (waits for approval)
curl -X POST https://app.peak-atlas.com/api/v1/actions/form.request_publish \
  -H "Authorization: Bearer $PEAK_AGENT_TOKEN" \
  -H "content-type: application/json" \
  -H "Idempotency-Key: form-erstgespraech-publish-01" \
  -d '{"form_id":"<id>","expected_revision":3,"expected_fingerprint":"<fingerprint>"}'

# 202 {"status":"approval_required","approvalId":"..."}
# Status: GET /api/v1/approvals/<approvalId>

Frequently asked questions

How often is a webhook retried?

Up to six attempts, spread from one minute to twelve hours, always with the same ID. Respond quickly with 2xx and process asynchronously.

Does the iframe resize?

Yes, with the full embed code from Peak Forms. It contains a short script that follows the height.

Does the webhook contain all answers?

Yes, under data.answers, plus name, e-mail and campaign details where available.

Is there a responses API?

Not as a list. Use the webhook for new responses and the CSV export for existing ones. An agent with the forms.responses.read permission reads a single response through form.get_decision_card.

How do I get an API key?

Create an agent under Settings → AI & agents. Its key starts with peak_agt_, works for one workspace and cannot publish without approval.

Goes well with this