CreateWebhookEndpointResp

  • Type: object

    Returned by POST /webhook-endpoints — extends the standard WebhookEndpointResp with the signing secret. The secret is shown ONCE here and never again — store it immediately. To recover from a lost secret, rotate via POST /webhook-endpoints/{id}/rotate-secret.

    • secret
      Type: string
      required

      Signing secret for verifying the authenticity of webhook deliveries.

      Algorithm: HMAC-SHA256(secret, '<t>.<raw-body>'), where <t> is the unix-millisecond timestamp the signature was computed against.

      Header: X-Webhook-Signature: t=<t>,v1=<sig>[,v1=<sig>...]. The t= part carries the timestamp, v1= carries the scheme version, and multiple v1= entries may appear during a rotation grace window — verification with either of your stored secrets passes.

      Replay protection: reject events whose t= is more than 5 minutes from your server's clock — prevents an attacker who captures a valid signed payload from re-sending it later.

      Returned only here at create time — store it immediately, it cannot be retrieved again.

    • createdAt
      Type: stringFormat: date-time

      When the webhook endpoint was created.

    • description
      Type: string

      Free-text label set on create / update.

    • eventTypes
      Type: array string[] · WebhookEventType[]enum

      Event types currently subscribed.

      values
      • workflow.started
      • workflow.failed
      • workflow.completed
      • workflow.declined
      • workflow.voided
    • id
      Type: string

      Webhook endpoint ID. Stable for the life of the config — survives pause / resume and is preserved across secret rotations.

    • isActive
      Type: boolean

      true when the webhook is firing; false when paused. Paused webhooks don't count against the per-namespace cap of 4 active webhooks.

    • retryConfig
      Type: object

      Retry policy applied to failed deliveries (network errors, non-2xx responses).

    • updatedAt
      Type: stringFormat: date-time

      Last update to any field (URL, eventTypes, description, isActive, secret rotation).

    • url
      Type: stringFormat: uri

      Endpoint currently receiving deliveries for this config.