Docs
OverviewGuidesZero & MCPAPI referenceChangelog
Webhooks

Create Webhook Endpoint

Subscribe a URL to event types. Each event is POSTed as JSON `{id, type, created_at, workspace_id, data}` with `X-ReachOut-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>.<body>")>`; any 2xx is a success, anything else is retried with exponential backoff (8 attempts over ~9 hours), then the delivery is `dead` and can be replayed. After `WEBHOOKS_DISABLE_AFTER_FAILURES` (default 20) consecutive failed attempts the endpoint is disabled. The URL must resolve to public addresses (`https://` in production). The signing secret is in the response only once. At most `WEBHOOKS_MAX_PER_WORKSPACE` (default 10) endpoints.

API key access

Needs the admin scope with an API key (ro_pat_...). A signed-in session uses the caller's role.
POST/api/v1/webhook-endpoints

Authorization

AuthorizationBearer <token>

Access token from /api/v1/auth/login, or an API key (ro_pat_..., RO-176) from /api/v1/workspaces/current/api-keys: the key implies its workspace and needs the route's scope. MCP connectors (/api/v1/mcp only) may use an OAuth access token (ro_oat_..., RO-284).

In: header

Header Parameters

X-Workspace-Id?string | null

Id of the workspace to act on (must be a member).

Request Body

urlstring

https:// in production; must resolve to public addresses only.

Length1 <= length <= 2048
event_typesarray<string>

Event types to receive (* = all), see event_types of the list.

Items1 <= items <= 50
description?string | null
Lengthlength <= 200
enabled?boolean | null

Default true.

Response Body

curl -X POST "http://localhost:8000/api/v1/webhook-endpoints" \  -H "X-Workspace-Id: string" \  -H "Content-Type: application/json" \  -d '{    "url": "string",    "event_types": [      "string"    ]  }'
{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "url": "string",
  "description": "string",
  "event_types": [
    "string"
  ],
  "secret_prefix": "string",
  "enabled": true,
  "disabled_reason": "string",
  "disabled_at": "2019-08-24T14:15:22Z",
  "consecutive_failures": 0,
  "last_success_at": "2019-08-24T14:15:22Z",
  "last_failure_at": "2019-08-24T14:15:22Z",
  "created_by": "ee824cad-d7a6-4f48-87dc-e8461a9201c4",
  "created_at": "2019-08-24T14:15:22Z",
  "updated_at": "2019-08-24T14:15:22Z",
  "secret": "whsec_Ab3dEfGhIjKlMnOpQrStUvWxYz0123456789abcdefg"
}
Empty
Empty
{
  "detail": [
    {
      "loc": [
        "string"
      ],
      "msg": "string",
      "type": "string",
      "input": null,
      "ctx": {}
    }
  ]
}

Account Mail Webhook

RO-251: mail webhooks of a workspace's own Unipile account (its `mail` provider override; the URL is its `webhook_url`), authenticated by that account's webhook secret in `Unipile-Auth`. Only mailboxes connected through that account are processed. 401 for a wrong secret or an unknown account.

Delete Webhook Endpoint

Delete the endpoint and its delivery log; pending deliveries are dropped.