Registry API
Webhooks
Organization-owned endpoints that receive signed event notifications.
A new webhook endpoint starts inactive. The verify operation sends a signed ownership challenge and activates the endpoint on a 2xx acknowledgment; changing its URL resets it to inactive.
Test pings are rate-limited and guarded against server-side request forgery, and the delivery history is redacted: it never includes the secret or the signature.
Operations
| Request | What it does |
|---|---|
| POST /api/v1/webhooks | Create a webhook endpoint (starts inactive; requires ownership challenge) |
| GET /api/v1/webhooks | List webhook endpoints for the org |
| GET /api/v1/webhooks/{id}/deliveries | Recent deliveries for an endpoint (redacted — no secret/signature) |
| PATCH /api/v1/webhooks/{id} | Update a webhook endpoint (URL change re-validates + resets to inactive) |
| DELETE /api/v1/webhooks/{id} | Delete a webhook endpoint |
| POST /api/v1/webhooks/{id}/verify | Send a signed ownership-challenge ping; activate on a 2xx ack |
| POST /api/v1/webhooks/{id}/test | Send a signed test ping (rate-limited, SSRF-guarded) |
Paths and summaries come from apps/api/openapi.json, which CI regenerates from the route definitions; this site checks its list against that file. Only the Public operations work without a token; everything else needs a signed-in session or an API token.