v2

latestOpenAPI 3.1.0Source-specific upstream terms; see response catalog metadata2026-07-26139203447.9 KB

User

Webhooks

Create an outbound webhook

Validates HTTPS destination against SSRF, accepts only the explicit payload-contract 1.0 event allowlist, and atomically stores both the encrypted signing secret and an encrypted 24-hour idempotency replay. An identical Idempotency-Key retry returns the same secret without creating a second webhook. Wildcards and unknown events fail closed with 400.

post/api/v1/user/webhooks

Headers

X-CSRF-Tokenstring required

Fresh token returned by GET /api/v1/user/me for this authenticated session.

Idempotency-Keystring required

Required for account mutations that reveal a secret. Reuse the same key only for an identical payload. The encrypted response can be replayed for 24 hours; a changed payload or an expired key returns 409.

Request body

urlstring uri required

eventsOutboundWebhookEventTypeV1[] required

Events with a currently wired durable producer. Contracted-but-unwired event types are not subscribable. An empty input is normalized to alert.triggered; wildcard, inactive and unknown values are rejected.

Response

Created, or the exact signing secret replayed for the same key and payload

oktrue required

secret_visible_oncetrue required

idempotency_replayedboolean required

idempotency_expires_atinteger required

Unix timestamp for the encrypted replay window.