Webhooks

Registers a webhook subscription (an instant-trigger endpoint).

Requires ManageOrganizations and an Idempotency-Key header. The response includes the HMAC signingSecret<b>once</b> — store it to verify the X-Flex-Signature-V2 (timestamped, replay-safe) and X-Flex-Signature headers; it is never retrievable again. The URL must be a public https endpoint. Attributed to the key's creator. Example: { "url": "https://hooks.zapier.com/…", "events": ["job.completed"] }.

post/api/v1/webhooks

Request

  • Base URL: https://app.flexonthejob.com
  • URL: https://app.flexonthejob.com/api/v1/webhooks
  • Auth: HTTP bearer

Request body

urlstring nullable

The absolute https URL to POST events to. Public hosts only (no localhost/private ranges). Required.

eventsstring[] nullable

The event names to subscribe to (at least one; see GET /api/v1/webhooks/events). Example: ["job.completed"].

Response

Created; Location points at the subscription. Body includes signingSecret.

idinteger

Numeric id of the subscription. Example: 42.

urlstring

The absolute https URL that receives the event payloads.

eventsstring[]

The subscribed event names (see GET /api/v1/webhooks/events). Example: ["job.completed","invoice.paid"].

activeboolean

Whether the subscription is currently delivering. Auto-disables after repeated failures.

createdAtstring date-time

When the subscription was created, ISO-8601 UTC.

signingSecretstring nullable

The HMAC signing secret for verifying the X-Flex-Signature-V2 (t=<unix seconds>,v1=<hex> over "<t>.<raw body>") and legacy X-Flex-Signature headers. Returned <b>only</b> in the response to POST /api/v1/webhooks (shown once, never retrievable again); null otherwise.

Changes

No recorded changes to this operation across all 1 revision of this API.