Skip to main content
POST
Publish a new version of a webhook

Authorizations

hookie_session
string
cookie
required

The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the X-Requested-With CSRF header.

Headers

Idempotency-Key
string

Makes a POST safe to retry for 24 hours: the same key, credential, path and body returns the stored response (Idempotent-Replayed: true) instead of running again. 422 if the key was used for a different request; 409 while the first is in flight.

Required string length: 1 - 255

Path Parameters

project_id
string
required

Project id (UUID) belonging to the caller workspace.

id
string
required

Id of any existing webhook row sharing the base slug to version.

Body

application/json

A complete webhook spec (same validator as create) plus the optional major flag.

name
string
required
Required string length: 1 - 80
slug
string
required

Must equal the base slug of the webhook named by {id}.

Pattern: ^[a-z0-9][a-z0-9-]{0,46}$
dataset
string
required
Pattern: ^[A-Za-z][A-Za-z0-9_]{0,62}$
enabled
boolean
default:true
criteria
object[]
Maximum array length: 10
mappings
object[]
Maximum array length: 50
dedupe_path
string | null

Opt-in (HK-006): the payload field whose value identifies an event, as a mapping path names one (for example "event_id" or "data.id"; not $payload, $submission.id or $submission.received_at). A POST whose body has the same non-empty string, or the same number, there as an earlier POST to this endpoint is answered 200 with that submission's id, idempotent: true and deduplicated_by: "body", and creates no record or run. A missing field, or a value that is neither, deduplicates nothing. An Idempotency-Key header and a provider delivery id still take precedence. The window is the submission's retention: a repeat is deduplicated for as long as the first submission is kept (the plan's retention window), after which the submission is pruned and a repeat is stored again. This is not the 24-hour Idempotency-Key replay on /admin/api. Off when omitted or null. It is set per version (POST .../versions) and cannot be changed with PATCH.

Maximum string length: 200
Example:

"event_id"

major
boolean
default:false

true bumps the major version (2), otherwise the minor is incremented (1.1).

Response

New version created with its own high-entropy public slug (not returned here - read it back from the webhook list) and its own mirror rule. The per-project webhook cap is NOT re-checked on this path.

id
string
required
slug
string
required

DEPRECATED shape: the versioned readable id, <base_slug>-v<version>. Matches no column and never appears in a URL. Use base_slug + version, or webhook_slug for the URL.

Example:

"orders-v1"

base_slug
string

The readable identity you supplied. NOT the public URL segment. Safe to log.

Example:

"orders"

version
string

Endpoint version within base_slug.

Example:

"1"

webhook_slug
string

The high-entropy public URL segment. THIS IS THE CREDENTIAL — anyone holding it can post events. Never log it.

Example:

"aBcXyz0123456789abcdefgh"

public_path
string

The endpoint's public location, {workspace}/{project}/{webhook_slug}. Pass this straight to a POST; it needs no assembly. It contains the credential, so treat it as a secret.

Example:

"acme-3f9a/orders/aBcXyz0123456789abcdefgh"

public_url
string<uri>

public_path as an absolute URL on this deployment. Contains the credential — treat it as a secret.

Example:

"https://app.hookie.ai/acme-3f9a/orders/aBcXyz0123456789abcdefgh"