Webhooks

Register a webhook endpoint

Validates the URL against the same SSRF guard used at delivery time (rejects loopback, private ranges, and the cloud metadata address). Returns the signing secret (X-ContextQ-Signature HMAC key) only this once — no other read ever reveals it, except a subsequent rotate-secret call.

post/api/webhook-endpoints

Request

  • Base URL: http://localhost:38200
  • URL: http://localhost:38200/api/webhook-endpoints
  • Auth: one of:
    • HTTP bearer
    • API key in cookie token

Request body

urlstring required
descriptionstring
eventTypesLifecycleEventType[]

Empty/omitted subscribes to every lifecycle event type.

Response

Created endpoint plus the signing secret (shown once).

idinteger
tenantIdinteger
urlstring
descriptionstring nullable
eventTypesLifecycleEventType[]

Empty array means "subscribed to every lifecycle event type".

status'active' | 'paused' | 'revoked'
secretstring nullable

Populated only on create and rotate-secret responses.

lastDeliveryAtstring date-time nullable
lastDeliveryStatusstring nullable
lastDeliveryErrorstring nullable
createdByUserIdinteger nullable
createdAtstring date-time
updatedAtstring date-time

Changes

No recorded changes to this operation across all 1 revision of this API.