Create library webhook

POST

/api/v1/webhooks

const url = 'http://127.0.0.1:8080/api/v1/webhooks';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"enabled":true,"event_types":["example"],"name":"example","url":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://127.0.0.1:8080/api/v1/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "enabled": true, "event_types": [ "example" ], "name": "example", "url": "example" }'

Library owners manage this library’s subscriptions. Instance administrators manage instance security-event subscriptions through /instance-webhooks. Personal tokens cannot manage either. Destinations require HTTPS and public DNS addresses unless a deployment operator explicitly trusts a private CIDR. DNS is checked on each connection; up to three method-preserving HTTPS redirects are revalidated before following. Events contain IDs and minimal facts, never recipe bodies or credentials. Delivery is at least once. Receivers verify the exact body with HMAC-SHA256 over timestamp + ‘.’ + body using Savorum-Signature: t=,v1=, reject timestamps outside five minutes, then persistently deduplicate delivery_id. Savorum-Delivery-ID and Savorum-Event-ID also occur inside the signed body. Secrets appear once on create or rotate. Rotation immediately invalidates the old key for future attempts, including queued retries. Keep signing-key files with private instance backups. Retries cover network failures, 408, 429, and 5xx: up to eight attempts per cycle within 24 hours, exponential delay from 15 seconds with jitter, capped at one hour, honoring bounded Retry-After. Other statuses end the cycle. History retains up to 1000 finished deliveries per subscription for 30 days and 32 attempts per delivery. Repeated final failures automatically pause delivery; fix the receiver before re-enabling. Paused subscriptions retain queued work but do not subscribe to new events. Creation accepts Idempotency-Key; reuse it only with the same request. Receipts last at least 24 hours.

Authorizations

bearerToken
browserSession

Parameters

Header Parameters

Idempotency-Key

string

<= 200 characters

Optional retry key. Receipts retain the created identity for at least 24 hours. A replay returns the current authorized resource; one-time secrets are omitted.

Request Body^required

application/json

object

enabled

required

boolean

event_types

required

Array<string> | null

>= 1 items <= 50 items

name

required

string

>= 1 characters <= 100 characters

url

required

string

>= 1 characters <= 2048 characters

Example^generated

{
  "enabled": true,
  "event_types": [
    "example"
  ],
  "name": "example",
  "url": "example"
}

Responses

201

Created

application/json

object

secret

required

string

subscription

required

object

consecutive_failures

required

integer format: int64

created_at

required

string format: date-time

enabled

required

boolean

event_types

required

Array<string> | null

required

string

library_id

string

name

required

string

pause_reason

string

revision

required

integer format: int64

secret_rotated_at

required

string format: date-time

updated_at

required

string format: date-time

updated_by

required

string

url

required

string

key

additional properties

any

key

additional properties

any

Example^generated

{
  "secret": "example",
  "subscription": {
    "consecutive_failures": 1,
    "created_at": "2026-04-15T12:00:00Z",
    "enabled": true,
    "event_types": [
      "example"
    ],
    "id": "example",
    "library_id": "example",
    "name": "example",
    "pause_reason": "example",
    "revision": 1,
    "secret_rotated_at": "2026-04-15T12:00:00Z",
    "updated_at": "2026-04-15T12:00:00Z",
    "updated_by": "example",
    "url": "example"
  }
}

Headers

ETag

string

401

No valid session or API token (authentication-required), or the credential sent is invalid (invalid-credentials).

application/problem+json

object

code

required

string

detail

required

string

status

required

integer format: int64

title

required

string

type

required

string

key

additional properties

any

Example^generated

{
  "code": "example",
  "detail": "example",
  "status": 1,
  "title": "example",
  "type": "example"
}

409

Creation retry refused

application/problem+json

object

code

Stable application error code; clients may also use the problem type suffix.

string

detail

A human-readable explanation specific to this occurrence of the problem.

string

errors

Optional list of individual error details

Array<object> | null

object

location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string

message

Error message text

string

value

The value at the given location

key

additional properties

any

instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri

params

Structured context for the stable error code.

object

key

additional properties

any

status

HTTP status code

integer format: int64

title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string

type

A URI reference to human-readable documentation for the error.

string format: uri

default: about:blank

violations

Array<object>

object

code

required

string

location

required

string

params

object

key

additional properties

any

key

additional properties

any

Example

{
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}

422

Creation retry refused

application/problem+json

object

code

Stable application error code; clients may also use the problem type suffix.

string

detail

A human-readable explanation specific to this occurrence of the problem.

string

errors

Optional list of individual error details

Array<object> | null

object

location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string

message

Error message text

string

value

The value at the given location

key

additional properties

any

instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri

params

Structured context for the stable error code.

object

key

additional properties

any

status

HTTP status code

integer format: int64

title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string

type

A URI reference to human-readable documentation for the error.

string format: uri

default: about:blank

violations

Array<object>

object

code

required

string

location

required

string

params

object

key

additional properties

any

key

additional properties

any

Example

{
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}

429

Creation retry refused

application/problem+json

object

code

Stable application error code; clients may also use the problem type suffix.

string

detail

A human-readable explanation specific to this occurrence of the problem.

string

errors

Optional list of individual error details

Array<object> | null

object

location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string

message

Error message text

string

value

The value at the given location

key

additional properties

any

instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri

params

Structured context for the stable error code.

object

key

additional properties

any

status

HTTP status code

integer format: int64

title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string

type

A URI reference to human-readable documentation for the error.

string format: uri

default: about:blank

violations

Array<object>

object

code

required

string

location

required

string

params

object

key

additional properties

any

key

additional properties

any

Example

{
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}

503

Creation retry refused

application/problem+json

object

code

Stable application error code; clients may also use the problem type suffix.

string

detail

A human-readable explanation specific to this occurrence of the problem.

string

errors

Optional list of individual error details

Array<object> | null

object

location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string

message

Error message text

string

value

The value at the given location

key

additional properties

any

instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri

params

Structured context for the stable error code.

object

key

additional properties

any

status

HTTP status code

integer format: int64

title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string

type

A URI reference to human-readable documentation for the error.

string format: uri

default: about:blank

violations

Array<object>

object

code

required

string

location

required

string

params

object

key

additional properties

any

key

additional properties

any

Example

{
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}

default

Error

application/problem+json

object

code

Stable application error code; clients may also use the problem type suffix.

string

detail

A human-readable explanation specific to this occurrence of the problem.

string

errors

Optional list of individual error details

Array<object> | null

object

location

Where the error occurred, e.g. ‘body.items[3].tags’ or ‘path.thing-id’

string

message

Error message text

string

value

The value at the given location

key

additional properties

any

instance

A URI reference that identifies the specific occurrence of the problem.

string format: uri

params

Structured context for the stable error code.

object

key

additional properties

any

status

HTTP status code

integer format: int64

title

A short, human-readable summary of the problem type. This value should not change between occurrences of the error.

string

type

A URI reference to human-readable documentation for the error.

string format: uri

default: about:blank

violations

Array<object>

object

code

required

string

location

required

string

params

object

key

additional properties

any

key

additional properties

any

Example

{
  "detail": "Property foo is required but is missing.",
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank"
}

Create library webhook

Authorizations

Parameters

Header Parameters

Request Bodyrequired

Examplegenerated

Responses

201

Examplegenerated

Headers

401

Examplegenerated

409

Example

422

Example

429

Example

503

Example

default

Example

Request Body^required

Example^generated

Example^generated

Example^generated