List webhook endpoints.
Every endpoint of the workspace, paused ones included, newest first. Needs `manage`, like creating them: receiver URLs often carry credentials.
Every endpoint of the workspace, paused ones included, newest first. Needs manage, like creating them: receiver URLs often carry credentials.
bearerAuthAuthorizationBearer <token>A Sluby API key (sluby_...) sent as Authorization: Bearer <key>. Keys carry scopes: upload, read, manage.
Endpoints.
application/json- response
data*array<>curl -X GET 'https://sluby.example.com/api/v1/webhooks'{ "data": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "url": "string", "events": [ "string" ], "is_active": true, "created_at": "2019-08-24T14:15:22Z", "last_delivery_at": "2019-08-24T14:15:22Z", "last_delivery_ok": true } ]}Delete an API key. DELETE
Previous Page
Register a webhook endpoint for the workspace. POST
Events are delivered for the workspace’s assets. Each request carries X-Sluby-Event, X-Sluby-Delivery (the same on every retry of one delivery), X-Sluby-Timestamp (Unix seconds, per attempt) and X-Sluby-Signature-V1, the hex HMAC-SHA256 of `<timestamp>.<raw body>` with the endpoint secret; receivers should refuse a timestamp more than five minutes from their clock. X-Sluby-Signature (the HMAC of the body alone) is still sent but deprecated, since it does not bind a time. The body is `{ id, event, timestamp, data }`, where `id` identifies the event across retries. The URL must be http(s) and its host must resolve only to public addresses (or to the operator's WEBHOOK_ALLOWED_NETWORKS); this is checked again before every delivery, redirects are not followed and response bodies are not read or stored. The secret is returned once.