Webhooks

Returns the addresses registered for your account, oldest first. Registered addresses receive every batch_completed and recipe_completed event of your account, in addition to the webhook_url of a single request (an address identical to the request's webhook_url is delivered once). Each delivery is signed exactly like a webhook_url delivery, with the same 3 attempts (waiting 2 s and 4 s), 10-second timeout and no redirects. You can register at most 5 addresses.

Registers an address that receives your account's webhook events. Registered addresses receive every batch_completed and recipe_completed event of your account, in addition to the webhook_url of a single request (an address identical to the request's webhook_url is delivered once). Each delivery is signed exactly like a webhook_url delivery, with the same 3 attempts (waiting 2 s and 4 s), 10-second timeout and no redirects. You can register at most 5 addresses. Registering the same address again returns the existing registration and sends no second email. The address must be an https URL that resolves to a public address. The account owner is emailed a notice naming the address's host (never its path or query), because a registered address receives every event; notice_sent is false when no email was sent, and never means the registration failed.

Permanently deletes a registered address and erases its stored URL; no further event is delivered to it. Only addresses registered by your own account can be deleted; any other id, or an already deleted one, returns 404. The account owner is emailed a notice naming the address's host (never its path or query); notice_sent is false when no email was sent, and never means the deletion failed.

Returns the secret that signs every webhook delivery of your account, creating it on the first call. Every key of one account returns the same secret. Verify a delivery by recomputing v1= plus the lowercase hex HMAC-SHA256 of <X-Scarleta-Timestamp>.<raw body> keyed with this secret, and reject a timestamp more than 300 seconds from your clock. After a revocation this route answers 409 signing_secret_revoked until you rotate.

Revokes the signing secret. No webhook is delivered, to any address, until you rotate to a new secret. A revoked secret is never accepted as the previous secret. The account owner is emailed a notice. notice_sent is false when no email was sent, including when the secret was already revoked: revoking an already revoked secret changes nothing, it answers 200 with the original revoked_at and notice_sent: false, and sends no second email. Answers 404 no_signing_secret when the account has no secret yet.

Creates a new signing secret and returns it. The new secret is in this response and can be read again with GET /v1/webhooks/signing-secret. For one day after a rotation each delivery also carries X-Scarleta-Signature-Previous, signed with the old secret, so a receiver that has not switched yet can verify that header with its old secret and you can switch over without dropping events. A rotation after a revocation restores deliveries. The account owner is emailed a notice that never contains the secret; notice_sent is false when no email was sent.