Skip to main content
POST
Configure Webhook

Configure Webhook

Sets the account’s webhook URL. There is one URL per account, and both events go to it.
An API key cannot call this. Changing the webhook URL — or reading the signing secret — requires a session you opened yourself on the website. With an API key the request is rejected:
Response
A stolen key would otherwise be enough to point your events at someone else’s server. Set the URL in Dashboard → API instead; the same page shows the signing secret.

Request body

string
required
Webhook URL. HTTPS only on this endpoint, and it must not point at localhost, 127.0.0.1, 0.0.0.0 or ::1. Deliveries are additionally refused at send time to any host that resolves to a private, loopback or link-local address.

Response

string
The URL now configured.
string
The signing secret for X-Webhook-Signature. Generated the first time a URL is set on the account and stable afterwards.
Response

The dashboard door

The dashboard uses a second pair of endpoints on the same account-level fields — GET /api/v1/account/webhook to read the URL and secret, and PATCH /api/v1/account/webhook to set or clear them. They accept the same values with two differences: PATCH also allows an http:// URL, and sending {"webhook_url": null} clears the webhook. Clearing the URL keeps the secret, so re-enabling the webhook later does not invalidate the verification code you already deployed. Both endpoints require a website session as well.