Webhooks

The webhook registry journeys reference by name, so workflow code never hardcodes a URL. A webhook carries its own signing secret (shown once at creation) and payloads follow the Standard Webhooks convention (v: 1 version field, webhook-id / webhook-timestamp / webhook-signature headers). A webhook with too many consecutive failures auto-disables and records skipped_disabled until re-enabled. All mutations require org:admin.

POST /v1/webhooks

Create a webhook

Auth: Session token.

Request body

{
  "data": {
    "name": "string",
    "config": {
      "url": "https://example.com/hooks/cowliss"
    }
  }
}

Field	Type	Required	Constraints
data	object	yes
data.name	string	yes	length 1–100
data.config	object	yes
data.config.url	string (uri)	yes

Response 201

{
  "data": {
    "id": "string",
    "orgId": "string",
    "name": "string",
    "config": {
      "url": "https://example.com/hooks/cowliss"
    },
    "webhookPayloadVersion": 42,
    "disabledAt": "2026-01-15T09:30:00.000Z",
    "createdAt": "2026-01-15T09:30:00.000Z",
    "updatedAt": "2026-01-15T09:30:00.000Z",
    "signingSecret": "string"
  },
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.id	string	yes
data.orgId	string	yes
data.name	string	yes
data.config	object	yes
data.config.url	string (uri)	yes
data.webhookPayloadVersion	integer	yes	-2147483648 ≤ x ≤ 2147483647
data.disabledAt	string (date-time) | null	yes
data.createdAt	string (date-time)	yes
data.updatedAt	string (date-time)	yes
data.signingSecret	string	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.

GET /v1/webhooks

List webhooks

Auth: Session token.

Query parameters

{
  "cursor": "string",
  "limit": 50,
  "q": "string"
}

Field	Type	Required	Constraints
cursor	string	no
limit	integer	no	default 50; 1 ≤ x ≤ 100
q	string	no	length 0–200

Response 200

{
  "data": [
    {
      "id": "string",
      "orgId": "string",
      "name": "string",
      "config": {
        "url": "https://example.com/hooks/cowliss"
      },
      "webhookPayloadVersion": 42,
      "disabledAt": "2026-01-15T09:30:00.000Z",
      "createdAt": "2026-01-15T09:30:00.000Z",
      "updatedAt": "2026-01-15T09:30:00.000Z"
    }
  ],
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object[]	yes
data[]	object	yes
data[].id	string	yes
data[].orgId	string	yes
data[].name	string	yes
data[].config	object	yes
data[].config.url	string (uri)	yes
data[].webhookPayloadVersion	integer	yes	-2147483648 ≤ x ≤ 2147483647
data[].disabledAt	string (date-time) | null	yes
data[].createdAt	string (date-time)	yes
data[].updatedAt	string (date-time)	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.

GET /v1/webhooks/{id}

Fetch one webhook

Auth: Session token.

Response 200

{
  "data": {
    "id": "string",
    "orgId": "string",
    "name": "string",
    "config": {
      "url": "https://example.com/hooks/cowliss"
    },
    "webhookPayloadVersion": 42,
    "disabledAt": "2026-01-15T09:30:00.000Z",
    "createdAt": "2026-01-15T09:30:00.000Z",
    "updatedAt": "2026-01-15T09:30:00.000Z"
  },
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.id	string	yes
data.orgId	string	yes
data.name	string	yes
data.config	object	yes
data.config.url	string (uri)	yes
data.webhookPayloadVersion	integer	yes	-2147483648 ≤ x ≤ 2147483647
data.disabledAt	string (date-time) | null	yes
data.createdAt	string (date-time)	yes
data.updatedAt	string (date-time)	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.

PATCH /v1/webhooks/{id}

Update a webhook

Auth: Session token.

Request body

{
  "data": {
    "name": "string",
    "config": {
      "url": "https://example.com/hooks/cowliss"
    },
    "enabled": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.name	string	no	length 1–100
data.config	object	no
data.config.url	string (uri)	yes
data.enabled	boolean	no

Response 200

{
  "data": {
    "id": "string",
    "orgId": "string",
    "name": "string",
    "config": {
      "url": "https://example.com/hooks/cowliss"
    },
    "webhookPayloadVersion": 42,
    "disabledAt": "2026-01-15T09:30:00.000Z",
    "createdAt": "2026-01-15T09:30:00.000Z",
    "updatedAt": "2026-01-15T09:30:00.000Z"
  },
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.id	string	yes
data.orgId	string	yes
data.name	string	yes
data.config	object	yes
data.config.url	string (uri)	yes
data.webhookPayloadVersion	integer	yes	-2147483648 ≤ x ≤ 2147483647
data.disabledAt	string (date-time) | null	yes
data.createdAt	string (date-time)	yes
data.updatedAt	string (date-time)	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.

DELETE /v1/webhooks/{id}

Delete a webhook

Auth: Session token.

Response 200

{
  "data": {
    "deleted": true
  },
  "meta": {
    "requestId": "string",
    "nextCursor": "string",
    "hasMore": true
  }
}

Field	Type	Required	Constraints
data	object	yes
data.deleted	true	yes
meta	object	no
meta.requestId	string	no
meta.nextCursor	string | null	no
meta.hasMore	boolean	no

Errors follow the shared envelope and code table.