Connect RastroAff to Zapier with webhooks: conversions to Sheets, Slack or your CRM

Webhooks let RastroAff tell other systems about events as they happen: a new conversion, a status change, a new or approved affiliate, a payout. With Zapier (or Make, or n8n) you can then add a row to Google Sheets, post in Slack or create a contact in your CRM, without writing code.

Events you can send

Event	When
conversion.created	A new conversion is recorded
conversion.status_changed	A conversion is approved, rejected or reversed
affiliate.signed_up	An affiliate signs up
affiliate.approved	You approve an affiliate
payout.requested	An affiliate requests a payout
payout.status_changed	A payout is approved, paid or rejected

1. Create the trigger in Zapier

1. In Zapier, create a Zap and choose Webhooks by Zapier as the trigger (available on Zapier's paid plans).
2. Choose Catch Hook and continue.
3. Copy the URL Zapier shows you (it starts with https://hooks.zapier.com/hooks/catch/).

2. Add the webhook in RastroAff

1. In your network's panel, open API and find Webhooks (administrators, from the Starter plan).
2. Paste the Zapier URL, choose the events and click Create webhook.
3. Copy the signing secret shown once. You only need it if you verify signatures yourself.
4. Click Send test. RastroAff sends a webhook.test event and shows Zapier's response.

3. Finish the Zap

Back in Zapier, click Test trigger: you will see the test event's fields. After the first real conversion, the conversion fields appear too. Add an action, for example Google Sheets → Create Spreadsheet Row or Slack → Send Channel Message, and map the fields.

What RastroAff sends

Every request is a POST with JSON:

{
  "id": "cmw1…",
  "event": "conversion.created",
  "createdAt": "2026-10-30T15:46:34.684Z",
  "data": {
    "id": "cmw2…",
    "status": "approved",
    "offer": "CMP-7K2M9XA1",
    "affiliate": "AFF-78HHEKM6",
    "clickId": "01JCW7R2KQ8M4T…",
    "transactionId": "order-1042",
    "goal": null,
    "payout": 25,
    "revenue": 30,
    "saleAmount": 99,
    "currency": "EUR",
    "country": "PT",
    "sub1": "facebook",
    "sub2": null,
    "sub3": null
  }
}

Status changes also include previousStatus. Headers: X-RastroAff-Event, X-RastroAff-Delivery (the delivery ID) and X-RastroAff-Signature.

Retries

If your endpoint doesn't answer with a 2xx status, RastroAff retries after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 12 hours. The API page lists recent deliveries and their responses. Use the delivery id to ignore duplicates.

Verifying the signature (your own server)

X-RastroAff-Signature looks like t=1730303194,v1=5f2b…. Compute HMAC-SHA256 of t + "." + raw body with your signing secret and compare it with v1; reject requests older than 5 minutes.

import crypto from "node:crypto";

function verify(secret, rawBody, header) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}

Zapier and Make don't check signatures; the URL itself is the secret, so don't share it.