Skip to main content
POST
Ingest an event into a configured webhook endpoint using an ingest key

Authorizations

Authorization
string
header
required

An ik_live_… ingest key. Stored hashed; the plaintext is returned once at creation.

Headers

Idempotency-Key
string

Optional. A repeat key short-circuits with 200 — after the webhook slug is resolved, but before the monthly quota is charged.

X-Hookie-Signature
string

Required only when the ingest key has require_signature set (this route uses the KEY's signature setting and signing secret, not the webhook's). Format 't=,v1=', v1 = HMAC-SHA-256 over '.'.

Path Parameters

ingest_key
string
required

The plaintext ingest key (prefix lookup + constant-time SHA-256 comparison). It authenticates the request; the tenant it belongs to scopes the webhook lookup.

slug
string
required

Webhook slug within the key's tenant. A bare slug selects the most recently created enabled webhook with that base slug; a versioned slug of the form '-v' (version = 1+ digits, optionally .digits, e.g. 'orders-v2' or 'orders-v2.1') pins that exact enabled version. Only enabled webhooks match.

Body

Form encodings are flattened (repeats become arrays, file parts become {filename, type, size} with the bytes discarded); every other Content-Type is parsed as JSON; an empty body becomes {}. The parsed payload is evaluated against the webhook's rule conditions and reshaped by its mappings (empty conditions match everything, empty mappings are identity). Over 1,000,000 bytes yields 413.

Any JSON value; its shape is whatever the webhook's rule conditions and mappings expect.

Response

Idempotent replay — a submission with this Idempotency-Key already exists for the tenant (or a concurrent insert lost the unique race). No quota charged.

submission_id
string
required
idempotent
enum<boolean>
required
Available options:
true