API reference

List all webhook endpoints for the authenticated account.

[
  {
    "id": "a1b2c3d4e5f6...",
    "name": "stripe-payments",
    "targetUrl": "https://example.com/hook",
    "hasHmacSecret": true,
    "hasTransformRules": false,
    "hasTransformScript": false,
    "transformScriptLanguage": "fsharp",
    "forwardsPaused": false,
    "forwardRateLimit": 10,
    "pollingEnabled": false,
    "mockEnabled": false,
    "requestCount": 42,
    "createdAt": "2026-01-15T10:00:00Z"
  }
]

Create a new webhook endpoint. Returns 201 with the full endpoint object (same shape as GET /api/v1/endpoints/{id}).

Required: name (letters, numbers, hyphens, underscores; max 64 chars).

Optional fields (all match the edit-endpoint form):

• targetUrl — legacy primary HTTP forward URL
• forwardTargets — JSON array of destinations (see forward targets schema)
• hmacSecret, signingScheme (none, suave, github, both)
• headerFilterRules, transformRules, transformScript, transformScriptLanguage — see transform scripts
• forwardsPaused, forwardRateLimit, pollingEnabled
• mockEnabled, mockStatusCode, mockHeaders, mockBody
• eventTypeHeader, idempotencyWindowSeconds, slackWebhookUrl

{
  "name": "stripe-payments",
  "targetUrl": "https://example.com/webhooks/stripe",
  "pollingEnabled": true,
  "forwardTargets": [
    {
      "name": "Primary",
      "type": "http",
      "url": "https://example.com/webhooks/stripe",
      "enabled": true,
      "conditions": null
    }
  ]
}

Errors: name_required, invalid_name, name_taken (409), endpoint_limit (429). Validation errors return 400 with an error message.

Full endpoint configuration. {id} is the 32-character hex UUID (no dashes).

Includes forwardTargets (with credentialsSet instead of secrets), transform rules, mock response settings, and integration options. hmacSecret is never returned — use hasHmacSecret.

{
  "id": "a1b2c3d4e5f6...",
  "name": "stripe-payments",
  "targetUrl": "https://example.com/hook",
  "forwardTargets": [ { "name": "Primary", "type": "http", "url": "..." } ],
  "hasHmacSecret": true,
  "signingScheme": "suave",
  "forwardsPaused": false,
  "forwardRateLimit": 10,
  "pollingEnabled": true,
  "mockEnabled": false,
  "requestCount": 42,
  "createdAt": "2026-01-15T10:00:00Z"
}

Update an endpoint. Send only the fields you want to change — omitted fields are left unchanged.

Accepts the same optional fields as create (except name, which is immutable). Set a string field to null to clear it (e.g. remove HMAC secret or Slack webhook).

Replacing forwardTargets replaces the entire target list. Include target id values from a prior GET to preserve stored cloud credentials — see credentials docs.

PATCH https://suavehooks.com/api/v1/endpoints/ENDPOINT_ID
Authorization: Bearer sh_YOUR_KEY
Content-Type: application/json

{
  "pollingEnabled": true,
  "forwardsPaused": false,
  "forwardRateLimit": 20
}

Returns the updated endpoint object. Errors: name_immutable (400), not_found (404).

Recent captured requests for an endpoint, newest first.

Query: limit — max items (default 50, max 200).

[
  {
    "id": "f1e2d3c4...",
    "endpointId": "a1b2c3d4...",
    "method": "POST",
    "queryString": "?foo=bar",
    "sourceIp": "203.0.113.10",
    "receivedAt": "2026-03-01T14:22:00Z",
    "bodySize": 1284
  }
]

Full capture detail: headers, body, and forward delivery log.

{
  "id": "f1e2d3c4...",
  "endpointId": "a1b2c3d4...",
  "method": "POST",
  "headers": [{ "name": "Content-Type", "value": "application/json" }],
  "queryString": "",
  "sourceIp": "203.0.113.10",
  "receivedAt": "2026-03-01T14:22:00Z",
  "body": {"event":"payment_intent.succeeded"},
  "forwardDeliveries": [
    {
      "id": "...",
      "targetUrl": "https://example.com/hook",
      "statusCode": 200,
      "attempt": 1,
      "elapsedMs": 145,
      "error": null,
      "deliveredAt": "2026-03-01T14:22:01Z"
    }
  ]
}