Sluby
REST APIWebhooks

Send a signed `webhook.test` event to the endpoint now.

Delivered once, signed like any event, and recorded with the deliveries. Answers how the receiver responded: `delivered`, `status_code` (null when no response came) and `error` (why it failed, in our words).

POST
/api/v1/webhooks/{id}/test

Delivered once, signed like any event, and recorded with the deliveries. Answers how the receiver responded: delivered, status_code (null when no response came) and error (why it failed, in our words).

Authorization

bearerAuth
headerAuthorizationBearer <token>

A Sluby API key (sluby_...) sent as Authorization: Bearer <key>. Keys carry scopes: upload, read, manage.

Path Parameters

id*string

Endpoint id.

Response Body

The outcome.

application/json
  1. response
delivered*boolean
status_code*integer|null
error*string|null
Example Request
curl -X POST 'https://sluby.example.com/api/v1/webhooks/string/test'
Example Response
{  "delivered": true,  "status_code": 0,  "error": "string"}

Register a webhook endpoint for the workspace. POST

Events are delivered for the workspace’s assets. Each request carries X-Sluby-Event, X-Sluby-Delivery (the same on every retry of one delivery), X-Sluby-Timestamp (Unix seconds, per attempt) and X-Sluby-Signature-V1, the hex HMAC-SHA256 of `<timestamp>.<raw body>` with the endpoint secret; receivers should refuse a timestamp more than five minutes from their clock. X-Sluby-Signature (the HMAC of the body alone) is still sent but deprecated, since it does not bind a time. The body is `{ id, event, timestamp, data }`, where `id` identifies the event across retries. The URL must be http(s) and its host must resolve only to public addresses (or to the operator's WEBHOOK_ALLOWED_NETWORKS); this is checked again before every delivery, redirects are not followed and response bodies are not read or stored. The secret is returned once.

Replace the signing secret of a webhook endpoint. POST

For a secret that leaked. The old secret stops at once: every request from now on, retries of earlier events included, is signed with the new one, which is returned only here.