Delete a webhook endpoint
Permanently (hard) deletes the endpoint — org-scoped, 404 for a cross-org or unknown id — mirroring how `deleteApiKey` hard-deletes a plugin key. The delete CASCADES (schema.prisma `onDelete: Cascade` on WebhookDelivery.endpointId, and from there to WebhookAttempt) to every delivery still queued for this endpoint: pending/in-flight deliveries for this endpoint stop existing rather than being left stuck. DELETE is naturally idempotent by HTTP semantics — this route does not use the Idempotency-Key ledger.
Permanently (hard) deletes the endpoint — org-scoped, 404 for a cross-org or unknown id — mirroring how deleteApiKey hard-deletes a plugin key. The delete CASCADES (schema.prisma onDelete: Cascade on WebhookDelivery.endpointId, and from there to WebhookAttempt) to every delivery still queued for this endpoint: pending/in-flight deliveries for this endpoint stop existing rather than being left stuck. DELETE is naturally idempotent by HTTP semantics — this route does not use the Idempotency-Key ledger.
Authorization
bearerAuth A gid_ API key (Settings → API keys) or an OAuth 2.1 access token.
In: header
Path Parameters
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X DELETE "https://example.com/v1/webhook-endpoints/string"{ "id": "string"}Update a webhook endpoint PATCH
Partial update of url/event_types/enabled — org-scoped, 404 for a cross-org or unknown id. NEVER rotates the secret (use the `rotate-secret` action). Changing `url` to a different value resets `verified` to false. The (re-validated) URL check can answer 422 `webhook_url_rejected`.
Rotate a webhook endpoint secret POST
Create-overlap-revoke rotation: mints a NEW signing secret (returned ONCE, same as create) and moves the CURRENT secret to `previous_secret_expires_at`-bounded overlap — the worker signs every delivery with BOTH secrets during that ~24h window so you can finish updating your verifier without dropping deliveries. Rotating a SECOND time before the first rotation's grace window elapses immediately drops the FIRST previous secret (there is only ever one previous-secret slot, not a stack) — do not chain rotations faster than your own verifier can keep up. Never mutates a secret in place; always mints fresh. Supports the optional `Idempotency-Key` header (a replay returns the SAME newly-minted secret again, never rotates twice for one logical request).