On Scale, Owners and Admins add a webhook URL in Settings, API and MCP. The URL must be public and use https. You get a signing secret once; keep it safe.
Events:
target.new: a company joined one of your buy boxes.signal.new: something new happened at a target your team saved.target.acquired: a target was acquired and left your feed.
Each event is a JSON POST with three headers: webhook-id, webhook-timestamp and webhook-signature. They follow the Standard Webhooks format, so most Standard Webhooks libraries can check them for you. To check by hand, compute an HMAC-SHA256 of id.timestamp.body using your secret (the part after whsec_, base64-decoded) and compare it to the value after v1,.
Answer with any 2xx code within 10 seconds. If you don't, we try again after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 24 hours. The same event always has the same webhook-id, so you can safely ignore repeats. After 25 failures in a row we turn the endpoint off and tell you; turn it back on from Settings. Use Send test to check your setup.