WebhookEndpoint
JSON:API resource for a webhook endpoint, with receiver URL, subscribed events, status, and secret representation.
ExtendsJsonApiResourceBase
Properties
| Field | Type | Description |
|---|---|---|
type* | string | JSON:API resource type. Always `webhook_endpoint`. |
id* | string (uuid) | Unique identifier of the webhook endpoint (UUID v4). |
attributes* | object | Webhook endpoint data (receiver URL, subscribed events, status, and secret). |
url* | string (uri) | URL that receives the webhook. In production it is rejected if it does not use HTTPS, if it resolves to a private address, or if it is longer than 2048 characters. |
events* | array | Events the endpoint subscribes to, from 1 to 10. |
description* | string | null | Free-form label to tell this endpoint apart from the others. |
status* | string | `active` receives deliveries. `disabled` was manually turned off. `auto_disabled` was turned off by the platform after exceeding the consecutive-failure threshold. |
consecutive_failures* | integer | Number of consecutive failures. Resets on the first success. |
last_delivery_at* | TimestampUTC | null | Date and time of the last successful delivery, in ISO 8601 UTC. `null` when the endpoint has not completed a delivery yet. |
secret | string | Shared secret for signature verification. **Only present** in the create and rotate-secret responses; omitted from every other response. It is used to validate the `X-Platform-Signature` and `X-Platform-Signature-Timestamped` headers on each delivery. |
secret_hint | string | Last 4 characters of the secret, prefixed with `...`. Present on any response where the full `secret` is hidden. |
created_at* | string (date-time) | ISO 8601 timestamp in UTC with an explicit `Z` suffix; for example, `"2026-05-01T05:14:38Z"`. The `*_at`, `*_end`, `*_start`, and `*_date` fields follow this format. `meta.datetime` describes the same contract in the response. |
updated_at* | string (date-time) | ISO 8601 timestamp in UTC with an explicit `Z` suffix; for example, `"2026-05-01T05:14:38Z"`. The `*_at`, `*_end`, `*_start`, and `*_date` fields follow this format. `meta.datetime` describes the same contract in the response. |
Used in operations
GET /v1/webhooksPOST /v1/webhooksPUT /v1/webhooks/{id}POST /v1/webhooks/{id}/regenerate-secret