Genaya

Returns every webhook endpoint configured for your organization, newest first. Endpoints are capped at 10 per organization (the cap is shared with endpoints created in the app under Settings > Developer > Webhooks), so the list is never paginated - has_more is always false. The signing secret is MASKED in this response (whsec_...ab12); the full secret is returned only once, in the 201 response that created the endpoint. Requires scope: webhooks:read.

Subscribes an HTTPS URL to one or more event types (or ["*"] for all events). This is the subscribe half of the REST-hook pattern integration platforms use: POST the target URL plus the events, store the returned id and secret, and DELETE the endpoint to unsubscribe. The 201 response is the ONLY response that carries the endpoint's full signing secret (whsec_...) - store it immediately; every later read returns it masked. Use the secret to verify the X-Genaya-Signature header on deliveries (t=unix,v1=hex HMAC-SHA256 of "t.rawBody"). URLs must be https (plaintext http, private/internal addresses, and embedded credentials are rejected with code invalid_url). Unknown event types are rejected with code unknown_event - fetch the catalog from GET /v1/webhook-endpoints/events. Creating an endpoint past the 10-per-org cap returns 400 with code endpoint_limit. Supports the Idempotency-Key header for safe retries. Requires scope: webhooks:write.

Returns the machine-readable catalog of event types an endpoint can subscribe to, so an integration can present the list without hardcoding it. New event types may be added over time - treat unrecognized types as ignorable rather than as errors. (The "Send test event" button in Settings > Developer > Webhooks also delivers a synthetic ping event that is not part of this catalog.) Requires scope: webhooks:read.

Returns a single webhook endpoint by id. The signing secret is masked - it is returned in full only in the create response. An endpoint belonging to another organization returns 404 rather than 403, so this can never confirm cross-tenant existence. Requires scope: webhooks:read.

Updates the URL, subscribed events, description, or status of an endpoint. Only provided fields are changed. Setting status to "enabled" also resets the endpoint's consecutive-failure streak, which is how you revive an endpoint that was automatically paused (status "auto_disabled") after repeated dead deliveries. The signing secret cannot be changed or re-revealed - delete the endpoint and create a new one to rotate it. Ownership is verified before the write, so an endpoint belonging to another organization returns 404. Requires scope: webhooks:write.

Deletes a webhook endpoint and stops all future deliveries to it. This is the unsubscribe half of the REST-hook pattern. Requires scope: webhooks:write.