BioFlow
API Reference

Create a webhook endpoint

POST /v1/webhook-endpoints — Register a public HTTPS URL for event delivery. The URL is SSRF-screened, then must accept a SIGNED endpoint.test event with 2xx…

POST
/v1/webhook-endpoints

Register a public HTTPS URL for event delivery. The URL is SSRF-screened, then must accept a SIGNED endpoint.test event with 2xx before anything is stored. The response carries the whsec_ signing secret exactly once. Deliveries are signed per Standard Webhooks (webhook-id / webhook-timestamp / webhook-signature over id.timestamp.rawBody), retried with exponential backoff for ~41 hours, and the endpoint auto-disables after 20 consecutive failures.

Requires scope: webhooks:write. Plan entitlement: public_api (Creator and Pro).

Consequential operation — send an Idempotency-Key header.

Authorization

AuthorizationBearer <token>

API key (bf_live_… / bf_test_…) as a Bearer token.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/webhook-endpoints" \  -H "Content-Type: application/json" \  -d '{    "url": "http://example.com",    "event_types": [      "contact.created"    ]  }'
{  "endpoint": {    "id": "string",    "url": "string",    "status": "ACTIVE",    "disabled_reason": "string",    "event_types": [      "contact.created"    ],    "consecutive_failures": 0,    "last_success_at": "2019-08-24T14:15:22Z",    "last_failure_at": "2019-08-24T14:15:22Z",    "previous_secret_expires_at": "2019-08-24T14:15:22Z",    "created_at": "2019-08-24T14:15:22Z",    "updated_at": "2019-08-24T14:15:22Z"  },  "secret": "string"}