Update endpoint configuration or enabled state
URL changes clear verification and disable delivery. Enabling requires verification and a signing secret. Replacing subscriptions changes future fan-out. Ask before modifying existing receiver configuration.
URL changes clear verification and disable delivery. Enabling requires verification and a signing secret. Replacing subscriptions changes future fan-out. Ask before modifying existing receiver configuration.
projectAPIKeyAuthorizationBearer <ch_dev_ or ch_live_ project API key>Read CASCADEHOOK_API_KEY from the local environment. Never print keys or headers. Scope is the project selected when the key was created.
endpoint_id*stringuuidapplication/json- body
Only supplied fields change; null is rejected. URL changes clear verification and disable delivery. Enabling requires a signing secret and verified ownership. event_types replaces the subscription list.
1 <= propertiesurl?stringHTTPS, no credentials/fragment. Maximum 2048 UTF-8 bytes. Public destination required at verification/delivery; redirects are rejected.
^[Hh][Tt][Tt][Pp][Ss]://urilength <= 2048enabled?booleanevent_types?array<>1 <= items <= 100Updated endpoint.
application/json- response
id*stringuuidproject_id*stringuuidurl*stringHTTPS, no credentials/fragment. Maximum 2048 UTF-8 bytes. Public destination required at verification/delivery; redirects are rejected.
^[Hh][Tt][Tt][Pp][Ss]://urilength <= 2048enabled*booleanverified_at*|date-timehas_signing_secret*booleanevent_types*array<>1 <= items <= 100created_at*stringdate-timeupdated_at*stringdate-timecurl -X PATCH 'https://api.cascadehook.com/v1/endpoints/497f6eca-6276-4993-bfeb-53cbbbba6f08' \ -H 'Content-Type: application/json' \ -d '{ "enabled": true}'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9", "url": "http://example.com", "enabled": true, "verified_at": "2019-08-24T14:15:22Z", "has_signing_secret": true, "event_types": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}Provision or rotate a signing secret POST
EMPTY BODY required: do not send {}. Also rotates an existing secret; ask for explicit approval before rotation. Not idempotent. Previous secret has a five-minute grace period; overlapping rotation returns 409 signing_secret_rotation_in_progress. Does not disable an already active endpoint or clear verified_at. Inspect state after a lost response.
Verify receiver ownership with a signed challenge POST
EMPTY BODY required: do not send {}. Install the current secret on a running public HTTPS receiver first. Receiver must verify the raw signed request and return exactly {"proof":"<base64 HMAC-SHA256>"}, using message cascadehook.verify.v1.<Webhook-Id>.<data.challenge>. One attempt per 30 seconds; respect Retry-After. Plain empty 200 is insufficient. Errors include endpoint_verification_failed (502), invalid_verification_proof (422), unsafe_endpoint_destination (422), endpoint_verification_rate_limited (429), and endpoint_verification_changed (409).