observability

Send lifecycle events to a URL.

Returns the webhook with its signing secret, shown this once (and to a retry by the same key with the same Idempotency-Key within 24 hours, until the secret is rotated). Each delivery is a POST of JSON {id, type, createdAt, data} with a Runtime-Signature header, t=<unix seconds>,v1=<hex HMAC-SHA256 of ${t}.${body} with the secret>; verify it with verifyWebhook in either SDK. Retries back off over about three days (10 attempts); answer 2xx within 10 seconds. At most 16 webhooks an account.

post/v1/webhooks

Request

Base URL: https://api.withruntime.com
URL: https://api.withruntime.com/v1/webhooks
Auth: HTTP bearer

Headers

Idempotency-Keystring

Replaying the same key with the same request within 24 hours returns the first result and never repeats the effect. A refusal is not kept: a request refused before it ran (no_capacity, busy, a limit) runs afresh when sent again with its key. The SDKs send one automatically; the server makes one when absent and returns it in the idempotency-key response header.

Request body

urlstring required

An https URL on the public internet.

descriptionstring

eventsstring[]

Which events to send; ["*"], the default, sends every type, including ones added later.

Response

Success

idstring required

urlstring required

descriptionstring nullable

eventsstring[] required

enabledboolean required

secretHintstring required

secretstring

The signing secret. Returned when the webhook is made (and to its own retry) and when its secret is rotated, and never again.

previousSecretExpiresAtstring nullable

createdAtstring

updatedAtstring

lastSuccessAtstring nullable

lastFailureAtstring nullable

failingSincestring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.