Skip to main content
POST

Request Body

string
required
Up to 100 characters.
string
required
https URL on a public host.
object
required
{ "type": "account" | "reseller" | "organization", "id": "<uuid>" } — must be within your API key’s scope.
string[]
required
Events available at that level (GET /v1/webhook-event-types).
object
Settings for monitoring events, keyed by event type. Required for each subscribed event that has settings; there are no defaults.
boolean
default:"true"
Also receive events from the levels below.
string
default:"nested"
nested or flat.
object
{ "mode": "hmac" | "shared_secret", "header_name"?: string, "secret"?: string }. Default HMAC with a generated secret. secret is optional and generated when omitted.
boolean
default:"false"
Skip events from Telzino test accounts.
string
Who is emailed when the endpoint fails.
A header name may use only letters, digits and hyphens (64 characters at most), and cannot be a reserved name: Host, Content-Length, Content-Type, Transfer-Encoding, Connection, User-Agent (any case), or any X-Telzino-* name other than X-Telzino-Secret. A reserved name returns 400 invalid_request with "<name> is a reserved header name; choose another one.".
The secret in the response is shown only once.
Other 400 invalid_request responses (error_description in quotes):
  • Invalid URL, not https, with credentials, or a private/loopback/link-local host: “Webhook URL is not a valid URL”, “Webhook URL must use HTTPS”, “Webhook URL must not contain credentials”, “Webhook URL must point at a public host, not a private, loopback or link-local address”.
  • Unknown or level-disallowed event: “These events are not available at the reseller level: foo.bar.” (the level is named as stored: partner for an account, reseller, or org for an organization).
  • Endpoint limit reached: “This level already has the maximum of N endpoints.”
  • Bad supplied auth.secret: “A secret must be 16-256 printable characters with no spaces.”
  • event_settings missing a required setting, out of range, or with an unknown event type or setting name: the message names the event and setting.
A scope outside what your API key can manage returns 403 with forbidden_scope.