Webhooks

Register a webhook endpoint.

Requires manage scope on a paid plan (paid_feature, 403, on free). Gated by the plan's webhook_limit (cap_reached, 403, body carries used/limit). url must be HTTPS and is SSRF-checked (invalid_url, 400) before the row is created. The response's secret is shown once — store it; it signs the X-Inboxy-Signature header on every delivery.

post/v1/webhooks

Request

  • Base URL: https://api.inboxy.net
  • URL: https://api.inboxy.net/v1/webhooks
  • Auth: HTTP bearer

Request body

urlstring uri required

HTTPS only; must not resolve to a private/reserved address.

Response

Created.

idstring uuid required
urlstring uri required
enabledboolean required

Auto-disabled after 5 consecutive delivery failures.

consecutive_failuresinteger required
last_statusstring nullable
last_delivery_atinteger nullable

Unix seconds.

created_atinteger required
secretstring

Plaintext signing secret. Only present in the response to POST /v1/webhooks and POST /v1/webhooks/{id}/rotate-secret — never returned by GET /v1/webhooks.

Changes

No recorded changes to this operation across all 1 revision of this API.