Webhooks

A link was edited

Sent to the acting user's webhooks (not necessarily the link creator's) when a link is edited with PATCH /api/links/{id} (data is the full updated Link) or in the Flyn dashboard (data is the id plus the changed fields).

Every delivery is an HTTP POST with a JSON body {event, timestamp, data}. X-Flyn-Signature is t=<timestamp>,v1=<hex>, where v1 is HMAC-SHA256 keyed with the full webhook secret (including the whsec_ prefix) over <t>.<raw request body>. To verify: split the header on commas, recompute the HMAC over t, a dot and the raw body bytes (not a re-serialised body), compare in constant time, and reject a t (milliseconds) older than your tolerance. Flyn makes one delivery attempt per event with a 10 s timeout (redirects included). A 2xx answer counts as success; a non-2xx answer counts as a failure, and after 10 counted failures in a row the webhook is set inactive. A URL whose host resolves to a private address or fails DNS resolution is not sent to and counts as a failure. Timeouts, connection errors and redirects to a private host are not counted.

postWebhooklink.update

Headers

X-Flyn-Signaturestring required

t=<unix ms>,v1=<hex HMAC-SHA256>.

X-Flyn-Eventstring required

The event name, same as event in the body.

User-Agent'Flyn-Webhook/1.0' required

Always Flyn-Webhook/1.0.

Payload

event'link.update' required
timestampinteger required

Unix time in milliseconds.

Response

Return any 2xx to acknowledge the delivery.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.