GetItDoneGetItDone Docs
API ReferenceWebhook endpoints

Create a webhook endpoint

Registers a new webhook endpoint in the credential's organization and mints its signing secret, returned EXACTLY ONCE in this response. The endpoint starts UNVERIFIED (`verified: false`) — call the `verify` action before relying on it; the worker only queues deliveries to enabled AND verified endpoints. The URL is validated at save time (https, port 443, no embedded credentials) — a disallowed URL answers 422 `webhook_url_rejected` and creates NO row. Supports the optional `Idempotency-Key` header; a replayed response includes the ORIGINAL plaintext secret again within the 24h replay window (same tradeoff as `createApiKey`).

POST
/v1/webhook-endpoints

Registers a new webhook endpoint in the credential's organization and mints its signing secret, returned EXACTLY ONCE in this response. The endpoint starts UNVERIFIED (verified: false) — call the verify action before relying on it; the worker only queues deliveries to enabled AND verified endpoints. The URL is validated at save time (https, port 443, no embedded credentials) — a disallowed URL answers 422 webhook_url_rejected and creates NO row. Supports the optional Idempotency-Key header; a replayed response includes the ORIGINAL plaintext secret again within the 24h replay window (same tradeoff as createApiKey).

Authorization

bearerAuth
AuthorizationBearer <token>

A gid_ API key (Settings → API keys) or an OAuth 2.1 access token.

In: header

Header Parameters

Idempotency-Key?string

Optional client-generated key (1-255 visible ASCII characters; a UUID works) making this POST safely retryable. Retrying with the SAME key and byte-identical body within 24h replays the stored first response (marked Idempotency-Replayed: true, never re-executed, never charged against quota). The same key with a different body answers 422 idempotency_key_reused; a retry racing the first execution answers 409 idempotency_in_progress. Omitting the header executes normally with no idempotency guarantee.

Length1 <= length <= 255

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Fields for registering a new webhook endpoint.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/webhook-endpoints" \  -H "Content-Type: application/json" \  -d '{    "url": "string"  }'
{  "id": "string",  "url": "string",  "enabled": true,  "event_types": [    "task.created"  ],  "verified": true,  "disabled_reason": "string",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "secret": "string"}

List webhook endpoints GET

Cursor-paginated list of the organization's webhook endpoints. PRO plan and above (`outbound_webhooks`) — a FREE-plan credential gets 403 `feature_not_enabled`. Never includes signing secrets.

Get a webhook endpoint GET

Fetches a single webhook endpoint by id, scoped to the credential's organization. An id from another organization (or an unknown id) answers 404 `resource_not_found` — no cross-org existence oracle. Never includes the signing secret.