Webhooks

Create a webhook subscription

Creates a webhook subscription. Returns 201 with the subscription record including a one-time secret used to verify future HMAC signatures - store it immediately, it is never returned again. No credit cost.

Select Masko-API-Version: 2026-09-26 (or api_version=2026-09-26) for the canonical mascot contract shown first. Existing unversioned clients keep legacy collection fields. A mascot_id query filter also selects the canonical contract. Mixing identifier names returns 400.

post/v1/webhooks

Request

  • Base URL: https://api.masko.ai
  • URL: https://api.masko.ai/v1/webhooks
  • Auth: HTTP bearer

Query parameters

api_version'2026-09-26' | 'legacy'

Equivalent to the version header, for polling URLs and clients that accept only relative paths. Header and query must agree.

Headers

Idempotency-Keystring

Account-scoped key (1 to 255 characters, ideally a UUID). Retries must preserve the credential workspace, effective API version, URL, content type and exact body bytes, including multipart boundaries; different inputs return 409 idempotency_key_reused. Completed responses, including 500 errors, replay for 24 hours after completion with current resource access checked again. Running or unconfirmed executions return 409 idempotency_request_in_progress and do not expire automatically. A receipt persistence failure returns 503 idempotency_persistence_failed: retry only with the same key and inspect the operation outcome before starting a new request.

Masko-API-Version'2026-09-26' | 'legacy'

Use 2026-09-26 for mascot_id resource fields. Unversioned shared routes retain the legacy contract.

Request body

urlstring uri required

HTTPS URL that receives webhook POSTs as JSON. Each delivery includes Masko-Signature (t=<unix-seconds>,v1=<hmac-hex of "<t>.<body>">), X-Masko-Signature (sha256=<hmac-hex of body>), X-Masko-Timestamp, X-Masko-Event, and Masko-Event-Id headers. The body carries a stable event id that every retry reuses. A non-2xx response or network error is retried after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, and 12 hours. Auto-disables after 100 consecutive failed attempts.

eventsstring[]

Event types to subscribe to. Omit for all events. Available events: job.completed, job.failed.

Response

Created webhook

Changes

No recorded changes to this operation across all 1 revision of this API.