Automation
Ballot Signal + Universal webhook
What is Universal webhook?
The honest answer to 'do you integrate with X?' when X is not on this list — and the reason our coverage claim does not depend on a marketplace review queue.
It sits in the Automation category of a campaign stack. The universal escape hatch — webhook, Zapier, CSV.
Who uses it
Nonpartisan. Used across both parties and by nonpartisan organizations.
How the Ballot Signal + Universal webhook integration works
The complete supporter record as JSON — contact fields, address, every consent field, page-intent signals, UTM parameters, referrer, resolution method and the dedupe key. Each POST carries an HMAC-SHA256 signature over the raw request body plus a timestamp header to defeat replay attacks. This is the integration everything else is built on: if a tool can receive a POST, it can receive a supporter record.
What syncs
- Supporter record (full)
- Consent granted / revoked events
- Intent signals
Field mapping
The supporter record is the same shape everywhere. What changes is where each field lands. The full record is documented on what you get.
| Supporter record | Payload | Notes |
|---|---|---|
| firstName, lastName | JSON payload or CSV row | Left empty rather than guessed when resolution is not confident. |
| JSON payload or CSV row — primary identifier | Primary match key. Lowercased before hashing. | |
| phone | JSON payload or CSV row — phone field | Present does not imply consent to be contacted on it. |
| addressLine1, city, state, zip | JSON payload or CSV row — address fields | Third dedupe fallback. |
| consentTimestamp | Included by default, every field | ISO 8601, UTC. |
| consentVersion | Included by default, every field | The language in force at the moment of consent. |
| consentSource | Included by default, every field | The exact page URL where consent was captured. |
| consentCategories | Included by default, every field | Normalized from your consent platform. |
| intentSignals | Payload attributes | Donate-page, volunteer-page, issue-page and any you define. |
| utmSource, utmMedium, utmCampaign, referrer | Included by default, every field or source fields | Carried verbatim. |
| dedupeKey | Match key | Lowercased email hash. Match order: dedupeKey, then phone, then name + address. |
How to set it up
- 1
In Ballot Signal, add a webhook destination and copy the signing secret.
- 2
Implement signature verification on your endpoint — compute HMAC-SHA256 over the raw body and compare in constant time.
- 3
Reject any request whose timestamp header is older than five minutes.
- 4
Return 2xx quickly and process asynchronously; we retry with exponential backoff on non-2xx.
- 5
Send a test event from the dashboard and confirm your handler validates it.
- 6
Monitor the delivery log for the first week.
Why it matters
The honest answer to 'do you integrate with X?' when X is not on this list — and the reason our coverage claim does not depend on a marketplace review queue.
Related integrations
All Automation →CSV export
The exit door. A vendor who makes export hard is telling you something about the relationship — we make it a button.
Slack
Puts a warm supporter in front of a human in seconds — the difference between a record and a phone call.
Zapier
The fastest route to broad coverage: one app, thousands of destinations, without waiting on every vendor's roadmap.
Make
Visual automation with far more logic per scenario than Zapier — useful when routing rules get complicated.
Ballot Signal + Universal webhook: questions
Is the Universal webhook integration available today?
Live. Built, tested and available to every customer today. You can turn this on yourself without talking to us.
What authentication does the Universal webhook integration use?
HMAC-SHA256 signed POST. Credentials are stored encrypted and are never rendered back into the interface after entry.
Will this create duplicate records in Universal webhook?
No, assuming you leave deduplication on. We match on the lowercased-email hash first, then phone, then name plus address. On a match we update rather than create, and only the fields you have marked overwritable.
Does the consent record travel into Universal webhook?
Yes. Consent timestamp, consent version, consent source URL and granted categories are included in every push, by default, and there is no configuration that strips them. That is the point of the product.
See what your own website already knows.
Book a 20-minute walkthrough. We will look at your site's current consent posture first — that part is useful whether or not you buy anything.