Webhooks and events

Where events go, how each delivery went, and the record of every event.

Send Authorization: Bearer vk_test_... on every call. Every route of Webhooks and events.

POST/v1/webhooks/{endpoint_id}/roll-secretNew signing secret; the old one is accepted for 24 hours.

Your API key, scope setup or all. On the card: events. Over HTTP it is made from the contract: fill in each {…} and every value.

Request1 field

Path

endpoint_idstringrequiredThe webhook endpoint's id (whk_...).

Type: string

Answers 20012 fields

idstringThe endpoint (whk_...).

Example: whk_2bq

object"webhook_endpoint"Always webhook_endpoint.

Type: "webhook_endpoint"

urlstringWhere the events go.

Type: string

events(string | "*")[]The events it wants.

Type: (string | "*")[]

descriptionstring | nullYour note; null when you gave none.

Type: string | null

activebooleanWhether events are sent to it.

Type: boolean

mode"live" | "test"The mode it hears: test or live, the mode of the key that made it. A test endpoint never hears a live event.

Type: "live" | "test"

deployment_idstring | nullOnly this deployment's events reach it (dep_...), plus your account's, such as keys, users and usage alerts. Set when a deployment's vestra.yaml declared the endpoint. Null: every event its types allow.

Type: string | null

managed_by"file" | nullfile: declared in that deployment's vestra.yaml, so deploying the file changes it; null: you made it.

Type: "file" | null

created_atstringWhen it was made, as an ISO 8601 time.

Type: string

updated_atstringWhen it last changed, as an ISO 8601 time.

Type: string

secretstringThe signing secret, shown this once: check every delivery against it (the Vestra-Signature header). Keep it on your server.

Example: whsec_...

HTTP

No sample in your language for this route, so here it is over HTTP.

curl -X POST "$VESTRA_BASE_URL/v1/webhooks/{endpoint_id}/roll-secret" \  -H "Authorization: Bearer $VESTRA_API_KEY"