Verify a webhook endpoint
Live, synchronous probe: SSRF-checks the stored URL, then POSTs a signed synthetic test request (Standard Webhooks headers; event type `webhook.verification` — NOT part of the delivery vocabulary, never persisted as a WebhookEvent) and requires a 2xx to mark the endpoint verified. This is a re-runnable probe, not a consequential write — no Idempotency-Key support (`idempotent: false`). A failure reports `verified: false` with a `reason` and does NOT unset a previously-earned verified state.
Live, synchronous probe: SSRF-checks the stored URL, then POSTs a signed synthetic test request (Standard Webhooks headers; event type webhook.verification — NOT part of the delivery vocabulary, never persisted as a WebhookEvent) and requires a 2xx to mark the endpoint verified. This is a re-runnable probe, not a consequential write — no Idempotency-Key support (idempotent: false). A failure reports verified: false with a reason and does NOT unset a previously-earned verified state.
Authorization
bearerAuth A gid_ API key (Settings → API keys) or an OAuth 2.1 access token.
In: header
Path Parameters
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/v1/webhook-endpoints/string/verify"{ "verified": true, "status": -9007199254740991, "reason": "string"}Rotate a webhook endpoint secret POST
Create-overlap-revoke rotation: mints a NEW signing secret (returned ONCE, same as create) and moves the CURRENT secret to `previous_secret_expires_at`-bounded overlap — the worker signs every delivery with BOTH secrets during that ~24h window so you can finish updating your verifier without dropping deliveries. Rotating a SECOND time before the first rotation's grace window elapses immediately drops the FIRST previous secret (there is only ever one previous-secret slot, not a stack) — do not chain rotations faster than your own verifier can keep up. Never mutates a secret in place; always mints fresh. Supports the optional `Idempotency-Key` header (a replay returns the SAME newly-minted secret again, never rotates twice for one logical request).
Send a test event to a webhook endpoint POST
Sends a synchronous, signed sample of a REAL event type (default `task.created`, using a representative sample task payload in the same TaskDto shape real deliveries carry) directly to the endpoint's URL and returns the immediate HTTP outcome. Does NOT create a queued WebhookDelivery row and never appears in the delivery log — it is a live probe, not a domain event. Re-runnable; no Idempotency-Key support.