Sign in
User
Webhooks

Create an outbound webhook

Validates HTTPS destination against SSRF, accepts only the explicit payload-contract 1.0 event allowlist, and atomically stores both the encrypted signing secret and an encrypted 24-hour idempotency replay. An identical Idempotency-Key retry returns the same secret without creating a second webhook. Wildcards and unknown events fail closed with 400.

post/api/v1/user/webhooks

Headers

X-CSRF-Tokenstring required

Fresh token returned by GET /api/v1/user/me for this authenticated session.

Idempotency-Keystring required

Required for account mutations that reveal a secret. Reuse the same key only for an identical payload. The encrypted response can be replayed for 24 hours; a changed payload or an expired key returns 409.

Request body

urlstring uri required
eventsOutboundWebhookEventTypeV1[] required

Events with a currently wired durable producer. Contracted-but-unwired event types are not subscribable. An empty input is normalized to alert.triggered; wildcard, inactive and unknown values are rejected.

Response

Created, or the exact signing secret replayed for the same key and payload

oktrue required
secret_visible_oncetrue required
idempotency_replayedboolean required
idempotency_expires_atinteger required

Unix timestamp for the encrypted replay window.

Changes

Changed in 1 of the 3 revisions of this API.1