Create a webhook endpoint
POST /v1/webhook-endpoints — Register a public HTTPS URL for event delivery. The URL is SSRF-screened, then must accept a SIGNED endpoint.test event with 2xx…
Register a public HTTPS URL for event delivery. The URL is SSRF-screened, then must accept a SIGNED endpoint.test event with 2xx before anything is stored. The response carries the whsec_ signing secret exactly once. Deliveries are signed per Standard Webhooks (webhook-id / webhook-timestamp / webhook-signature over id.timestamp.rawBody), retried with exponential backoff for ~41 hours, and the endpoint auto-disables after 20 consecutive failures.
Requires scope: webhooks:write. Plan entitlement: public_api (Creator and Pro).
Consequential operation — send an Idempotency-Key header.
API key (bf_live_… / bf_test_…) as a Bearer token.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/v1/webhook-endpoints" \ -H "Content-Type: application/json" \ -d '{ "url": "http://example.com", "event_types": [ "contact.created" ] }'{ "endpoint": { "id": "string", "url": "string", "status": "ACTIVE", "disabled_reason": "string", "event_types": [ "contact.created" ], "consecutive_failures": 0, "last_success_at": "2019-08-24T14:15:22Z", "last_failure_at": "2019-08-24T14:15:22Z", "previous_secret_expires_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z" }, "secret": "string"}List webhook endpoints GET
GET /v1/webhook-endpoints — Every webhook endpoint in the workspace (at most 10 — no pagination). Signing secrets are never included. Requires scope webhooks:read.
Get a webhook endpoint GET
GET /v1/webhook-endpoints/{endpoint_id} — Get a webhook endpoint. Requires scope webhooks:read.