Webhook endpoint and delivery API

Creates an event subscription for an approved HTTPS receiver.

Send name, HTTPS url, nonempty event_types, and optional project_id. Omission selects permitted organization events; it does not grant access to projects outside the caller's authority. Unknown event types and unapproved receiver destinations return 422.

To subscribe a receiver to operation and backup outcomes, send:

{
  "name": "deployment-events",
  "url": "https://automation.example.com/infra/events",
  "project_id": "prj_payments",
  "event_types": ["operation.completed", "backup.failed"]
}

Returns 201 with endpoint ID, revision, and a one-time-revealed signing secret. The secret is not the API key used to create the endpoint. Delivery uses the signature and retry rules in Webhooks.

Updates the endpoint's configuration and event subscriptions.

Requires If-Match. Name, URL, enabled state, and event types are writable. Event types replace the full set; an empty set is rejected. Omitted fields remain unchanged.

A project scope cannot be expanded in place. Create an explicitly reviewed replacement endpoint for a different scope. Enabling or disabling does not reclassify an event that already occurred.

Returns delivery attempts and retry state.

Requires webhooks:read and supports event type, event ID, outcome, and pagination. Each result contains immutable event ID, delivery attempt ID, receiver status, next retry, and a redacted response excerpt.

Authentication headers and signing secrets are excluded. A receiver's response can still contain application data, so inspection follows the endpoint's scope.

Replays a retained event with a fresh delivery attempt.

Requires webhooks:write and an idempotency key. Returns 202 with a replay operation. It preserves the event ID and creates a new delivery attempt with fresh timestamp and signature.

An expired event returns 410 event_expired; a disabled endpoint returns 409 endpoint_disabled. Replay cannot supply a replacement event body.

Creates a replacement signing secret with an explicit overlap period.

Requires the endpoint ETag. It creates a new one-time-revealed secret with an explicit overlap duration. The allowed overlap is integer seconds 60–86400, with default 3600. Retire the old version after the receiver accepts the new one.

Deletes the endpoint and stops new delivery attempts.

Endpoint deletion stops new attempts but cannot undo events already processed by the receiver. See replay and deduplication for receiver state and API idempotency for follow-up mutations.