Create a webhook

Creates a webhook that delivers the subscribed activity events to a public HTTPS endpoint, and returns it. The signing secret appears only in this response. Every filter must name a known event code, and the endpoint must resolve to a public HTTPS URL.

POST /v1/webhooks

Authorization

Authorization Bearer token · header required

Authorization: Bearer <token> with an API key (sfa_ prefix), an OAuth access token, a session token, or a Space machine credential (sfm_ prefix).

or

Authorization OAuth2 access token · header required

OAuth 2.0 with Spacefast scopes. People use the authorization code flow; machines use client credentials.

Scopes: spaces:write

Request body

required application/json

• teamId string
  Team that owns the webhook. Omit when the credential reaches exactly one team.
  min length 1

• url string required
  Public HTTPS endpoint that receives each event. Loopback and private-network hosts are rejected.

• events string[]
  Activity event filters to subscribe to: exact codes, a prefix wildcard such as version.*, or * for every event.
  min items 1 · default: ["*"]

Responses

201 Response for status 201

• $schema string
  Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

• data object required
  Show properties Hide properties

  • id string required

  • url string required

  • events string[] required
    Event filters this webhook is subscribed to.

  • status string required

    active delivers. failing follows 8 consecutive failures and still delivers. disabled follows 32 and stops. deleted is kept for audit only. Any success resets the count.

    Allowed: active, disabled, failing, deleted

  • secret string
    Signing secret, present only in the response that created the webhook or rotated its secret. Store it then; it cannot be read back.

  • secretPreview string required
    First eight and last four characters of the current signing secret.

• previousSecretExpiresAt string | any required
  ISO 8601 timestamp when the secret replaced by the last rotation stops being accepted. Null when no earlier secret is still valid.

Show properties Hide properties

Any of:

• string

  • string<date-time>
  • any

• createdAt string required

  • updatedAt string required

default Error

Every 4xx and 5xx response is one RFC 9457 problem document served as application/problem+json.

• $schema string
  Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

• type string required
  URL of the documentation page for this error. Derived from code.

• title string required
  Human-readable name of the error type. Derived from code.

• status integer required
  HTTP status of the response, repeated in the body.
  min -9007199254740991 · max 9007199254740991

• detail string required
  What went wrong in this request.

• code string required
  Stable snake_case error code. Match on this, not on detail.

• pointer string
  RFC 6901 JSON Pointer to the request field or batch entry that failed, for example /files/37/path. Present on validation failures.

• details object
  Machine-readable context keyed by the error code.

• suggestions string[]
  Recovery steps safe to show to a person.

• next string[]
  Commands or API requests to run next, usable as written.

• requestId string required
  ID of this request, from the X-Request-Id header or generated. Quote it when contacting support.

Try it

Server

Base URL: https://api.spacefast.com
Custom base URL: Overrides the selected server when set.

Authorization

Bearer token Remember on this device
Include my values in samples

Body application/json

Request body

Send

Request

cURL

curl -X POST "https://api.spacefast.com/v1/webhooks" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{\n  "teamId": "string",\n  "url": "http://example.com",\n  "events": [\
    "*"\
  ]\n}'

JavaScript

const response = await fetch("https://api.spacefast.com/v1/webhooks", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Content-Type": "application/json"
  },
  body: "{\n  \"teamId\": \"string\",\n  \"url\": \"http://example.com\",\n  \"events\": [\n    \"*\"\n  ]\n}"
});

Python

import requests

response = requests.post(
    "https://api.spacefast.com/v1/webhooks",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Content-Type": "application/json"
    },
    data="{\n  \"teamId\": \"string\",\n  \"url\": \"http://example.com\",\n  \"events\": [\n    \"*\"\n  ]\n}",
)

Response

201 default

{
  "$schema": "http://example.com",
  "data": {
    "id": "string",
    "url": "http://example.com",
    "events": [\
      "string"\
    ],
    "status": "active",
    "secret": "string",
    "secretPreview": "string",
    "previousSecretExpiresAt": "2019-08-24T14:15:22Z",
    "createdAt": "2019-08-24T14:15:22Z",
    "updatedAt": "2019-08-24T14:15:22Z"
  }
}

{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [\
    "string"\
  ],
  "next": [\
    "string"\
  ],
  "requestId": "string"
}