A lead that sits in a dashboard until someone remembers to look is a lead that goes cold. The people who fill in a form at a shop counter or off a flyer are as warm as they’ll ever be in the first hour.
So QR campaigns plug into Mitr’s webhooks: when someone submits one of your QR forms, Mitr can send the lead to any URL you give it, straight away. From there it can reach whatever you use: an automation tool such as Zapier, Make or n8n, a Slack or Discord channel, or a CRM like HubSpot or Pipedrive. If it can receive a webhook, or sits behind a tool that can, it can get your leads.
The lead event
Add a webhook endpoint under Settings → Webhooks. A new QR lead sends an event called qr_lead, once per new lead (the same person submitting twice doesn’t send it twice):
{
"eventId": "…",
"eventType": "qr_lead",
"time": "2026-10-15T09:41:07+00:00",
"workspaceId": "…",
"campaignId": "…",
"campaignName": "Diwali offer",
"placement": "Shop window",
"lead": {
"name": "Asha",
"email": null,
"phone": "919876543210",
"attributes": { "interest": "Gold" },
"whatsappOptIn": true
}
}A few things worth knowing:
- It’s only sent for people who ticked the consent box. There is no lead, and so no event, without it.
placementtells you which flyer it came from, so your CRM can record the source.whatsappOptInis separate from consent to be contacted. It’s true only if they also agreed to WhatsApp messages. Respect it before you send anything.- Like every Mitr webhook, the request is signed and retried if your endpoint is down. The delivery log shows what was sent and what came back.
If you leave the event filter empty, the endpoint receives every event type, including qr_lead. If you only want leads, type qr_lead into the endpoint’s event types.
Two more events, on request
Scans can be sent too, but they’re far more frequent than leads, so they’re opt-in. An endpoint only receives them if you list them by name. An endpoint with an empty filter won’t get them, so turning this on can never flood an integration you set up earlier.
| Event | Sent when |
|---|---|
qr_scan | A scan is recorded. Includes the campaign, placement, device type, OS, browser and a coarse location (country, region, city). No visitor identifier, IP address or browser string |
qr_scan_cap_reached | The first scan your plan’s monthly recorded-scan allowance can’t take, once per month. It tells you the limit and the date it resets, so you can decide whether to upgrade |
Only scans that are actually recorded are sent. Bots, link previews and quick repeats are filtered out first, exactly as they are for your dashboard counts, so the webhook and the dashboard agree.
A few things people build with it
- A Slack message for every lead, with the placement in it, so the team sees which poster is working.
- A row in a Google Sheet for each lead, as a lightweight CRM.
- A task in your CRM, assigned to whoever covers that area, with a follow-up due the next morning.
- An alert when you hit your scan limit, so a busy campaign never goes quiet in the dashboard without you knowing.
Where to start
Create a QR campaign with a form, add a webhook that listens for qr_lead, and submit the form yourself from your phone. The delivery log shows the event arriving within a couple of minutes. The full webhook reference is at /docs/webhooks. If you haven’t set up QR campaigns yet, start with the overview, or start free.
Frequently asked questions
How do I send QR code leads to my CRM?
Add a webhook endpoint under Settings, then Webhooks, and point it at your CRM or an automation tool. When someone submits a QR form and ticks the consent box, Mitr sends a qr_lead event to that URL, signed and retried if your endpoint is down.
Do webhooks receive every QR scan too?
No. Scans are opt-in. An endpoint receives qr_scan and qr_scan_cap_reached events only if you list them by name in its event types, so an existing catch-all endpoint is never flooded.
Does a webhook fire twice if the same person submits the form twice?
No. qr_lead is sent once per new lead.
Does the scan webhook include personal data?
No. It carries the campaign, placement, time, device type, OS, browser and a coarse location. It does not include a visitor identifier, an IP address or the browser string.