Webhooks

Create a webhook

Subscribes an endpoint to events and returns the signing secret in full. Store it now: API-key callers only ever see a masked secret afterwards. The webhook is tagged with the caller's current workspace.

Auth: API key (Bearer flyn_sk_live_...), or the signed-in dashboard session cookie when no API key header is sent. MCP OAuth access tokens are not accepted here and get 401.

Plan: Pro, Lifetime or Team (a member of a paying owner's workspace has the effective plan team) only; Free gets 403 UPGRADE_REQUIRED. At most 10 webhooks per user (any status, any workspace).

Rate limit: 10 requests per 60 s per client IP, fixed window, in memory per server instance, checked before authentication.

An invalid JSON body, a non-string url or a non-array events returns 500.

post/api/webhooks

Request

  • Base URL: https://www.flyn.to
  • URL: https://www.flyn.to/api/webhooks
  • Auth: HTTP bearer

Request body

urlstring required

Endpoint that receives deliveries. Trimmed; http or https; must not resolve to a private address. A non-string value returns 500.

eventsWebhookEventName[] required

Events to subscribe to. Unknown names are dropped silently; 400 only when none remain. A non-array value returns 500.

Response

Created. secret is shown in full.

Changes

No recorded changes to this operation across all 1 revision of this API.