1. Decide what “valid” means before building nodes
Start with a small input contract. For a generic real estate lead, the minimum useful fields are usually a stable lead identifier, contact method, source, stage, and an explicit consent state. Your lawful basis and notice requirements depend on your organization and market; a technical boolean does not create valid consent by itself.
- lead_id: a stable internal identifier, not a name.
- email or phone: require only the contact method your process actually needs.
- source: use a controlled value such as website, referral, or manual entry.
- stage: normalize free text into a documented set of stages.
- consent: block the relevant route when the required consent signal is absent.
2. Separate normalization from the decision
Use one node to trim strings, normalize case, map known stage aliases, and construct a predictable object. Use a separate decision node to determine whether the normalized payload can continue. This makes the failure route visible and easier to test.
{
"lead_id": "demo-lead-001",
"email": "buyer@example.test",
"source": "website",
"stage": "new",
"consent": true
}The example uses the reserved .test domain and synthetic identifiers. Do not paste a CRM export or real lead list into a template test.
3. Return a useful rejection
A rejected payload should explain which rule failed without echoing unnecessary personal data. A compact response can include a status, a list of missing or invalid fields, and a trace identifier created for the test run.
- Return an appropriate HTTP status such as 400 for a validation error.
- Do not silently route an invalid lead to the success branch.
- Do not include passwords, tokens, full payload dumps, or sensitive notes in the response.
4. Test both routes before connecting a CRM
At minimum, run one accepted fixture and one rejected fixture. Keep the workflow inactive after import, use a test webhook, and verify the exact response status and body. Only add an approved CRM credential after field mapping and failure behavior are understood.
- Import the workflow into a test n8n project.
- Confirm that it is inactive and has no credential bindings.
- Send the accepted synthetic payload.
- Send a second payload with consent removed or a required field missing.
- Confirm that each payload reaches the intended response node.
5. Keep the compliance boundary explicit
Validation improves data quality, but it does not decide your lawful basis, write privacy notices, handle deletion requests, or set retention periods. Document those responsibilities outside the workflow and review them before production use.