Register a webhook endpoint. The signing secret is returned IN FULL exactly once. Every delivery is a POST with headers X-Seomatic-Event, X-Seomatic-Delivery, X-Seomatic-Timestamp (unix seconds) and X-Seomatic-Signature: `t=<timestamp>,v1=<hex>`, where v1 = HMAC-SHA256(secret, `<timestamp>.<raw body>`). During a secret rotation the header carries one v1 per active secret (`t=..,v1=<new>,v1=<old>`): accept the event if ANY v1 matches. Verify with a constant-time compare and reject timestamps older than a few minutes (replay). Respond 410 Gone to unsubscribe: the endpoint is removed.

post/webhooks

Request

  • Base URL: https://app.seomatic.ai/api/v1
  • URL: https://app.seomatic.ai/api/v1/webhooks
  • Auth: HTTP bearer

Request body

urlstring uri required

https endpoint to receive signed POSTs.

eventsstring[]

Subscribed events. Empty = all events.

Response

The endpoint + its full signing secret

Changes

No recorded changes to this operation across all 1 revision of this API.