Get a webhook endpoint
Fetches a single webhook endpoint by id, scoped to the credential's organization. An id from another organization (or an unknown id) answers 404 `resource_not_found` — no cross-org existence oracle. Never includes the signing secret.
Fetches a single webhook endpoint by id, scoped to the credential's organization. An id from another organization (or an unknown id) answers 404 resource_not_found — no cross-org existence oracle. Never includes the signing secret.
Authorization
bearerAuth A gid_ API key (Settings → API keys) or an OAuth 2.1 access token.
In: header
Path Parameters
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/v1/webhook-endpoints/string"{ "id": "string", "url": "string", "enabled": true, "event_types": [ "task.created" ], "verified": true, "disabled_reason": "string", "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}Create a webhook endpoint POST
Registers a new webhook endpoint in the credential's organization and mints its signing secret, returned EXACTLY ONCE in this response. The endpoint starts UNVERIFIED (`verified: false`) — call the `verify` action before relying on it; the worker only queues deliveries to enabled AND verified endpoints. The URL is validated at save time (https, port 443, no embedded credentials) — a disallowed URL answers 422 `webhook_url_rejected` and creates NO row. Supports the optional `Idempotency-Key` header; a replayed response includes the ORIGINAL plaintext secret again within the 24h replay window (same tradeoff as `createApiKey`).
Update a webhook endpoint PATCH
Partial update of url/event_types/enabled — org-scoped, 404 for a cross-org or unknown id. NEVER rotates the secret (use the `rotate-secret` action). Changing `url` to a different value resets `verified` to false. The (re-validated) URL check can answer 422 `webhook_url_rejected`.