Sources

A source is one inbound pipe into an app: the first-party api source every app is created with, or a provider that pushes into it (Clerk today). Sources are created and listed under their parent app, and these routes address one by its own id. The signing secret in config is write-only and never present in any response: configured reports whether one is stored. Archiving is revocation: calls carrying that source id stop being accepted (403), and turning ingestion back on means creating a fresh api source with a new id to configure. The webhook receiver is public: the provider’s signature is the authorization, and the route answers the calling platform’s plain-text convention rather than the envelope. Every write is attributed to the source’s parent app. See the Apps and sources guide.

GET /v1/sources/{id}

Fetch one source

Auth: Clerk session token.

Response 200

{
  "data": {
    "id": "string",
    "orgId": "string",
    "appId": "string",
    "kind": "api",
    "config": "string",
    "lastReceivedAt": "2026-01-15T09:30:00.000Z",
    "createdAt": "2026-01-15T09:30:00.000Z",
    "updatedAt": "2026-01-15T09:30:00.000Z",
    "archivedAt": "2026-01-15T09:30:00.000Z",
    "configured": true
  },
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.id	string	yes
data.orgId	string	yes
data.appId	string	yes
data.kind	“api” | “clerk”	yes
data.config	string | number | boolean | null | record<string, any> | any[]	yes
data.lastReceivedAt	string (date-time) | null	yes
data.createdAt	string (date-time)	yes
data.updatedAt	string (date-time)	yes
data.archivedAt	string (date-time) | null	yes
data.configured	boolean	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.

PATCH /v1/sources/{id}

Set or rotate a source’s config

Auth: Clerk session token.

Request body

{
  "data": {
    "config": {}
  }
}

Field	Type	Required	Constraints
data	object	yes
data.config	any	yes

Response 200

{
  "data": {
    "id": "string",
    "orgId": "string",
    "appId": "string",
    "kind": "api",
    "config": "string",
    "lastReceivedAt": "2026-01-15T09:30:00.000Z",
    "createdAt": "2026-01-15T09:30:00.000Z",
    "updatedAt": "2026-01-15T09:30:00.000Z",
    "archivedAt": "2026-01-15T09:30:00.000Z",
    "configured": true
  },
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.id	string	yes
data.orgId	string	yes
data.appId	string	yes
data.kind	“api” | “clerk”	yes
data.config	string | number | boolean | null | record<string, any> | any[]	yes
data.lastReceivedAt	string (date-time) | null	yes
data.createdAt	string (date-time)	yes
data.updatedAt	string (date-time)	yes
data.archivedAt	string (date-time) | null	yes
data.configured	boolean	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.

DELETE /v1/sources/{id}

Archive a source

Auth: Clerk session token.

Response 200

{
  "data": {
    "id": "string",
    "orgId": "string",
    "appId": "string",
    "kind": "api",
    "config": "string",
    "lastReceivedAt": "2026-01-15T09:30:00.000Z",
    "createdAt": "2026-01-15T09:30:00.000Z",
    "updatedAt": "2026-01-15T09:30:00.000Z",
    "archivedAt": "2026-01-15T09:30:00.000Z",
    "configured": true
  },
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.id	string	yes
data.orgId	string	yes
data.appId	string	yes
data.kind	“api” | “clerk”	yes
data.config	string | number | boolean | null | record<string, any> | any[]	yes
data.lastReceivedAt	string (date-time) | null	yes
data.createdAt	string (date-time)	yes
data.updatedAt	string (date-time)	yes
data.archivedAt	string (date-time) | null	yes
data.configured	boolean	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.

POST /v1/sources/{sourceId}/webhook

Source webhook receiver (public)

Auth: None: verifies the caller’s own signature/token.

Errors follow the shared envelope and code table.