Register a webhook endpoint
Requires webhooks:manage. The endpoint is born in an environment and never leaves it: a test endpoint hears test traffic, a live one hears live traffic. Facts about the organization itself (organization.created, member.invited) carry no environment and go to the live endpoints — an organization has one real existence, and the test environment is where the customer plane is rehearsed, not where the organization is.
The signing secret comes back here because this is the moment you need it, but unlike an API key it is re-showable: losing this response is not losing the secret.
Autorizações
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.
Cabeçalhos
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.
Corpo
https:// only. Deliveries never cross plaintext, and a redirect is refused rather than followed — register the final address.
live, test A label, so a list of three endpoints says which is which.
Types from GET /v1/organization/webhooks/events. Omit or leave empty for every deliverable event.
Resposta
Created. secret is what deliveries are signed with.
Where deliveries are POSTed. https:// only.
Types from the published catalogue. Empty means every deliverable event — a new type then starts arriving without anything being changed here.
disabled is either your decision or the auto-disable after sustained failure. A disabled endpoint is queued nothing.
enabled, disabled Deliveries that spent every attempt, back to back. Any success resets it.
Deliveries that gave up in the last 24 hours.
The signing secret (uk_wh_…). Re-showable at /secret.
live, test