API reference

Webhooks

Delivery targets and the history. Needs its own scope webhooks:manage — whoever can change targets can redirect the event stream.

Operations

Operation	What it does	Scope
GET/v1/webhooks/endpoints	Your webhook endpoints — never the signing secret	`webhooks:manage`
POST/v1/webhooks/endpoints	Add an endpoint — the signing secret comes back once and never again	`webhooks:manage`
PATCH/v1/webhooks/endpoints/{id}	Change url, events, description or status	`webhooks:manage`
DELETE/v1/webhooks/endpoints/{id}	Remove an endpoint and its delivery history	`webhooks:manage`
POST/v1/webhooks/endpoints/{id}/rotate-secret	Issue a new signing secret without losing an event	`webhooks:manage`
POST/v1/webhooks/endpoints/{id}/test	Send a sample delivery to prove the path	`webhooks:manage`
GET/v1/webhooks/deliveries	Every delivery, newest first — status, code and last error	`webhooks:manage`
GET/v1/webhooks/deliveries/{id}	One delivery with every attempt: request, response, status code	`webhooks:manage`
POST/v1/webhooks/deliveries/{id}/retry	Send it again now — allowed after the automatic attempts ran out	`webhooks:manage`

A key that lacks one of these scopes is refused with 403 insufficient_scope, and error.missingScope names the one it was missing. Scopes are fixed when the key is issued.

Shared across these operations

The error envelope and the full list of error types are the same for every operation in the API, as are the object schemas the responses are built from. Neither is repeated per page.