Skip to main content
POST
Ingest an event with an ingest key, routed by the project's mapping rules

Authorizations

Authorization
string
header
required

An ik_live_… ingest key. Stored hashed; the plaintext is returned once at creation.

Headers

Idempotency-Key
string

Optional. If a submission with this key already exists for the tenant, the request short-circuits with 200 before the monthly quota is charged.

X-Hookie-Signature
string

Required only when the ingest key has require_signature set; ignored otherwise. Format: 't=,v1=' where v1 is HMAC-SHA-256 over '.' keyed with the key's signing secret.

Example:

"t=1700000000,v1=3ba8c0e9..."

Path Parameters

ingest_key
string
required

The plaintext ingest key. It is looked up by its first 16 characters (key_prefix) among non-revoked keys and then compared constant-time against the stored SHA-256 hash.

Body

Content-Type selects the parser: 'application/x-www-form-urlencoded' and 'multipart/form-data' are flattened into a shallow object (repeated fields become arrays; file parts become {filename, type, size} and their bytes are discarded). EVERY other Content-Type — including missing or wrong ones, which is deliberate so webhook providers that send JSON with an unhelpful Content-Type still work — is parsed as JSON. An empty body is accepted and becomes {}. Over 1,000,000 bytes yields 413.

Any JSON value. On this route the payload is fed to the project's mapping rules, so its shape is whatever the rules' conditions and mappings expect.

Response

Idempotent replay — a submission with this Idempotency-Key already exists for the tenant. No quota is charged when the duplicate is detected up front; a request that loses the unique-index race has already been counted against the monthly quota.

submission_id
string
required
idempotent
enum<boolean>
required
Available options:
true