POST/v1/webhooks

Create a webhook

create_webhook

The URL must use https, and its host must resolve to public addresses. Private (RFC 1918), loopback, link-local, cloud metadata and other special-purpose networks are rejected both at registration and on every connection. The signing secret is shown once in the response (secret); after that it can only be rotated. An organization can have at most 20 webhooks.

The subscription lists event types and domain masks (card.*, *). Access is set the same way as for an API key: role, data_profile_id and collection_ids. An event about an object that the role, the data profile or the collections cannot see is not delivered. tags limit card events to cards with any of the tags. payload: thin sends events without data. Custom headers (headers) and outbound authorization (auth) are stored encrypted; responses contain only the header names and the value_set and auth_set flags.

Authentication

Send an API key in the Authorization header: Authorization: Bearer <key>.

Header parameters

Idempotency-Keystring
Key for a safe retry of a write: 1 to 255 printable ASCII characters; a UUID v4 per logical operation is recommended. A retry with the same key within 24 hours does not run the operation again: it returns the saved response (status, headers and body) with the Idempotency-Replayed: true header. The same key with a different method, path, Content-Type or body returns 409 api.idempotency_mismatch; while the first request is still running, 409 api.idempotency_in_progress with Retry-After: 1. After a 5xx or 429 response the key is released, and a retry runs the operation again. The key is scoped to the organization and the caller (API key, user, or custom source key).
length ≥ 1, length ≤ 255

Request body

application/json

Object: WebhookCreate

urlstringrequired
Receiver URL, https:// only, up to 2048 characters.
length ≤ 2048
descriptionstring
length ≤ 200
eventsarray of WebhookEventFilterrequired
items ≥ 1
roleWebhookRole
data_profile_idinteger | null
collection_idsarray of integer
Collections the webhook receives events about. No value or an empty list means all collections available to the role and the data profile. A key that is itself restricted to collections creates a webhook only with a non-empty list of its own collections. Without this field, with an empty list or with a collection outside its list, the request returns 403 webhooks.collections_outside_key.
items ≤ 200
tagsarray of string
items ≤ 50
payloadWebhookPayloadMode
headersarray of WebhookHeaderInput
items ≤ 10
authWebhookAuthInput

Responses

201Created. This is the only time `secret` is shown.

Response headers

RateLimit-Policy
Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.
RateLimit
What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.
X-RateLimit-Limit
Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).
X-RateLimit-Remaining
Requests left under the strictest limit.
X-RateLimit-Reset
Seconds until the strictest limit resets.
Idempotency-Replayed
true means the response was replayed from the saved one for this Idempotency-Key: the operation did not run again.

application/json

Object: WebhookCreated

idintegerrequired
urlstringrequired
descriptionstringrequired
eventsarray of WebhookEventFilterrequired
activebooleanrequired
statusWebhookStatusrequired
paused_atstring (date-time) | null
paused_reasonstring | null
failures: 10 failed attempts in a row; feature_disabled: the plan does not include webhooks.
disabled_reasonstring | null
gone: the receiver answered 410; manual: disabled by an admin.
Allowed values: gonemanualnull
disabled_atstring (date-time) | null
roleWebhookRolerequired
data_profile_idinteger | null
Data profile of the webhook (null means no profile, as for an API key with the same role).
collection_idsarray of integerrequired
Collections the webhook receives events about; empty means all collections available to the role and the data profile.
tagsarray of stringrequired
Card events only for cards with any of these tags; empty means no filter.
payloadWebhookPayloadModerequired
headersarray of WebhookHeaderrequired
auth_typestring | null
Type of the outbound authorization (null means none).
Allowed values: bearerbasicnull
auth_setbooleanrequired
Whether outbound authorization is set (the values are never returned).
previous_secret_valid_untilstring (date-time) | null
Until when deliveries are also signed with the previous secret (null means there is no overlap).
healthWebhookHealth
consecutive_failuresintegerrequired
last_delivery_atstring (date-time) | null
last_success_atstring (date-time) | null
last_errorstring | null
created_byinteger | null
created_by_namestring | null
created_atstring (date-time)required
updated_atstring (date-time)required
secretstringrequired
whsec_ followed by 32 bytes in base64 (new secrets use the standard alphabet with padding, older ones use base64url). Store it on the receiver side; it never appears in API responses again. The Standard Webhooks signing key is the base64 decoding of the part after whsec_.
previous_valid_untilstring (date-time) | null
Until when the previous secret is still accepted (after a rotation). null on creation.

400The request is invalid: a parameter value or the state of the object does not allow the action (`detail` is a message).

Response headers

RateLimit-Policy
Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.
RateLimit
What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.
X-RateLimit-Limit
Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).
X-RateLimit-Remaining
Requests left under the strictest limit.
X-RateLimit-Reset
Seconds until the strictest limit resets.

application/json

Object: Error

401No credentials were sent (neither a session cookie nor an API key), or the key was not found.

Response headers

RateLimit-Policy
Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.
RateLimit
What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.
X-RateLimit-Limit
Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).
X-RateLimit-Remaining
Requests left under the strictest limit.
X-RateLimit-Reset
Seconds until the strictest limit resets.

application/json

Object: Error

403The action is not allowed: the role is insufficient, there is no access to the collection or card, the request runs in “View as” mode, or the organization is suspended or deleted (`detail` is an object with `code: org_suspended | org_deleted`).

Response headers

RateLimit-Policy
Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.
RateLimit
What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.
X-RateLimit-Limit
Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).
X-RateLimit-Remaining
Requests left under the strictest limit.
X-RateLimit-Reset
Seconds until the strictest limit resets.

application/json

Object: Error

409The state of the object does not allow the action, for example a duplicate, indexing in progress, or a job that is already processed.

Response headers

RateLimit-Policy
Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.
RateLimit
What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.
X-RateLimit-Limit
Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).
X-RateLimit-Remaining
Requests left under the strictest limit.
X-RateLimit-Reset
Seconds until the strictest limit resets.

application/json

Object: Error

422Validation error: the body or parameters do not match the schema (`detail` is a list of validation errors), or a parameter value is out of range (`detail` is a message).

Response headers

RateLimit-Policy
Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.
RateLimit
What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.
X-RateLimit-Limit
Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).
X-RateLimit-Remaining
Requests left under the strictest limit.
X-RateLimit-Reset
Seconds until the strictest limit resets.

application/json

Object: Error

429Too many requests (`api.rate_limited`), the organization's quota for the minute, day or month is used up (`api.quota_exceeded`; `error.details` holds `quota`, `limit` and `reset_at`), the organization's limit is reached, or the answer service is busy (`answers.engine_busy`). Wait for the time in the `Retry-After` header.

Response headers

Retry-After
Number of seconds to wait before you retry the request.
RateLimit-Policy
Limits in effect, in the format of the IETF draft draft-ietf-httpapi-ratelimit-headers: comma-separated items "<name>";q=<quota>;w=<window in seconds>. key is the request rate of the API key (the quota is the burst, the window is the time to refill it fully; for a session it is user, without credentials ip); minute, day and month are the organization's quotas for the calendar minute, day and month in UTC.
RateLimit
What is left of each limit in RateLimit-Policy: "<name>";r=<remaining>;t=<seconds until reset>.
X-RateLimit-Limit
Limit of the strictest entry in RateLimit-Policy (the one with the fewest requests left).
X-RateLimit-Remaining
Requests left under the strictest limit.
X-RateLimit-Reset
Seconds until the strictest limit resets.

application/json

Object: Error

Error codes

Codes this endpoint can return in error.code, besides the general codes of every request.

Safe retries

Send an Idempotency-Key header (for example a UUID) with each POST and PATCH. A retry with the same key within 24 hours returns the saved response instead of running the request again.

Rate limits

Responses carry the RateLimit and RateLimit-Policy headers and the earlier X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. A 429 response has Retry-After in seconds: wait and retry.

← webhooks · API reference

curl -X POST 'https://api.sursa.com/v1/webhooks' \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/webhooks/sursa","events":["card.*"]}' \
  -H "Authorization: Bearer $SURSA_API_KEY"

Try it

API key

The key stays in the memory of this tab and is sent only to https://api.sursa.com.

Requests act on the real data of your organization.

Idempotency-Key header

Idempotency-Key

A new key is generated for each request when this is empty.

Request body (JSON)