GetItDoneGetItDone Docs
API ReferenceWebhook endpoints

Create a webhook endpoint

POST
/v1/webhook-endpoints

Registers a new webhook endpoint in the credential's organization and mints its signing secret, returned EXACTLY ONCE in this response. The endpoint starts UNVERIFIED (verified: false) — call the verify action before relying on it; the worker only queues deliveries to enabled AND verified endpoints. The URL is validated at save time (https, port 443, no embedded credentials) — a disallowed URL answers 422 webhook_url_rejected and creates NO row. Supports the optional Idempotency-Key header; a replayed response includes the ORIGINAL plaintext secret again within the 24h replay window (same tradeoff as createApiKey).

Authorization

bearerAuth
headerAuthorizationBearer <token>

A gid_ API key (Profile → API Keys) or an OAuth 2.1 access token.

Header Parameters

Idempotency-Key?string

Optional client-generated key (1-255 visible ASCII characters; a UUID works) making this POST safely retryable. Retrying with the SAME key and byte-identical body within 24h replays the stored first response (marked Idempotency-Replayed: true, never re-executed, never charged against quota). The same key with a different body answers 422 idempotency_key_reused; a retry racing the first execution answers 409 idempotency_in_progress. Omitting the header executes normally with no idempotency guarantee.

Length1 <= length <= 255

Request Body

application/json
  1. body

Fields for registering a new webhook endpoint.

url*string

The https destination URL. Must be https, port 443 (explicit or default), and carry no user:pass@ credentials — a URL failing this check answers 422 webhook_url_rejected with the specific reason and creates NO row.

Length1 <= length <= 2048
event_types?array<>

Subset of event types to subscribe to. Omit or send an empty array to subscribe to every type.

enabled?boolean

Defaults to true.

Response Body

The created endpoint, with its plaintext secret shown once.

application/json
  1. response

A freshly registered endpoint, including its one-time signing secret. Starts UNVERIFIED — call the verify action to prove ownership before relying on deliveries.

id*string

Stable id of the endpoint.

url*string

The https destination URL.

enabled*boolean

False when disabled — manually, auto-disabled after repeated delivery failures, or paused when the account that set it up had its email address verified (see disabled_reason). A disabled endpoint receives nothing: deliveries already queued for it are held, not sent, and go out only if it is re-enabled.

event_types*array<>

Subscribed event types. An EMPTY array means "every type".

verified*boolean

True once the verify action has proven this endpoint accepts a correctly-signed request.

disabled_reason*|

Why the endpoint was auto-disabled or paused by an account take-back, or null when it never was.

created_at*string

ISO-8601 UTC.

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
Formatdate-time
updated_at*string

ISO-8601 UTC.

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
Formatdate-time
secret*string

The signing secret (whsec_…) — shown EXACTLY ONCE. Store it now; it cannot be retrieved again, only rotated. Note: replaying this exact request within the 24h Idempotency-Key window returns this SAME secret again — treat a stored Idempotency-Key as equally sensitive to the secret itself.

Example Request
curl -X POST 'https://app.nowgetitdone.com/v1/webhook-endpoints' \  -H 'Content-Type: application/json' \  -d '{  "url": "https://example.com/webhooks/getitdone"}'
Example Response
{  "id": "string",  "url": "string",  "enabled": true,  "event_types": [    "task.created"  ],  "verified": true,  "disabled_reason": "string",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "secret": "whsec_51f3...redacted"}

List webhook endpoints GET

Cursor-paginated list of the organization's webhook endpoints. PRO plan and above (outbound_webhooks) — a FREE-plan credential gets 403 feature_not_enabled.…

Get a webhook endpoint GET

Fetches a single webhook endpoint by id, scoped to the credential's organization. An id from another organization (or an unknown id) answers 404…