webhooks

Register a webhook endpoint

Register an address to be POSTed to when work finishes, so an integration can stop polling. The signing secret is in the response and nowhere else. The URL is checked at registration AND again before every delivery — https outside development, no username or password, no fragment, no non-default port in production, and every address it resolves to must be public. The connection is then pinned to the address that was checked, and a redirect is refused rather than followed. At most 10 active endpoints per account.

post/webhooks

Request

  • Base URL: https://api.gogoscreen.com/api/v1
  • URL: https://api.gogoscreen.com/api/v1/webhooks
  • Auth: one of:
    • HTTP bearer
    • HTTP bearer

Headers

Idempotency-Keystring required

1–128 characters, unique to this request. A retry with the same key and the same body returns the STORED response with Idempotent-Replayed: true; the same key with a different body is 409 idempotency_conflict; a duplicate still in flight is 409 idempotency_in_progress. Claims expire after 24 hours.

Request body

descriptionstring

What this endpoint is for. Shown in the console and in the account's audit trail.

eventsstring[] required

What to send. At least one; an unknown name is refused rather than ignored, because an endpoint subscribed to a typo would silently never fire.

urlstring required

Where to POST. https, a public address, no credentials in the URL.

Response

Register a webhook endpoint

secretstring required

THE SIGNING SECRET. This is the only time it is returned: it is stored encrypted and is never answered again. Verify every delivery with it — Gogoscreen-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>." + raw body)> — over the RAW request body, and reject a t more than five minutes from your clock.

Changes

No recorded changes to this operation across all 1 revision of this API.