Verify receiver ownership with a signed challenge
EMPTY BODY required: do not send {}. Install the current secret on a running public HTTPS receiver first. Receiver must verify the raw signed request and return exactly {"proof":"<base64 HMAC-SHA256>"}, using message cascadehook.verify.v1.<Webhook-Id>.<data.challenge>. One attempt per 30 seconds; respect Retry-After. Plain empty 200 is insufficient. Errors include endpoint_verification_failed (502), invalid_verification_proof (422), unsafe_endpoint_destination (422), endpoint_verification_rate_limited (429), and endpoint_verification_changed (409).
EMPTY BODY required: do not send {}. Install the current secret on a running public HTTPS receiver first. Receiver must verify the raw signed request and return exactly {"proof":""}, using message cascadehook.verify.v1..<data.challenge>. One attempt per 30 seconds; respect Retry-After. Plain empty 200 is insufficient. Errors include endpoint_verification_failed (502), invalid_verification_proof (422), unsafe_endpoint_destination (422), endpoint_verification_rate_limited (429), and endpoint_verification_changed (409).
projectAPIKeyAuthorizationBearer <ch_dev_ or ch_live_ project API key>Read CASCADEHOOK_API_KEY from the local environment. Never print keys or headers. Scope is the project selected when the key was created.
endpoint_id*stringuuidVerified endpoint. Delivery is not automatically enabled.
application/json- response
id*stringuuidproject_id*stringuuidurl*stringHTTPS, no credentials/fragment. Maximum 2048 UTF-8 bytes. Public destination required at verification/delivery; redirects are rejected.
^[Hh][Tt][Tt][Pp][Ss]://urilength <= 2048enabled*booleanverified_at*|date-timehas_signing_secret*booleanevent_types*array<>1 <= items <= 100created_at*stringdate-timeupdated_at*stringdate-timecurl -X POST 'https://api.cascadehook.com/v1/endpoints/497f6eca-6276-4993-bfeb-53cbbbba6f08/verify'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9", "url": "http://example.com", "enabled": true, "verified_at": "2019-08-24T14:15:22Z", "has_signing_secret": true, "event_types": [ "string" ], "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z"}Update endpoint configuration or enabled state PATCH
URL changes clear verification and disable delivery. Enabling requires verification and a signing secret. Replacing subscriptions changes future fan-out. Ask before modifying existing receiver configuration.
Read an event including its original envelope GET
Next Page