Cowdidocs
API ReferenceWebhooks

Get a webhook

GET
/v1/webhooks/{webhookId}

Reads one webhook of the caller's organization, with its signing key fingerprints. Requires the org:connect:read permission. Returns 404 when the caller's organization has no webhook with this id.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

webhookId*string

Unique identifier of the webhook.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/webhooks/550e8400-e29b-41d4-a716-446655440000"
{  "id": "550e8400-e29b-41d4-a716-446655440000",  "name": "sales-app",  "description": "Order updates for the sales app",  "url": "https://sales.example.com/hooks/cowdi",  "status": "ACTIVE",  "events": [    "approval.outcome"  ],  "timeout": "PT5S",  "signing_keys": [    {      "id": "550e8400-e29b-41d4-a716-446655440001",      "masked_secret": "whsec_...a1b2",      "created_at": "2026-09-01T10:15:30Z"    }  ],  "created_at": "2026-09-01T10:15:30Z",  "updated_at": "2026-10-15T14:22:00Z"}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

List subscribable event types GET

Lists the platform's public event vocabulary. Subscribe a webhook only to the event types listed here. Each entry carries its category, which is the resource the event happens to, so a picker can group the list. Requires the `org:connect:read` permission.

Update a webhook PATCH

Changes the URL, status, timeout, or the set of events this webhook receives. `events` is the complete set, so it is also how an event is added or removed. Omitted fields are left as they are. Requires the `org:connect:write` permission. Returns 400 when the URL is invalid or an `events` entry is not in the published vocabulary, 404 when the caller's organization has no webhook with this id, and 409 when the new URL already belongs to another webhook.