Webhook endpoints
List webhook endpoints
Lists the webhook endpoints of the organization with their status and subscribed events. Secrets are never returned. Read only. It is safe to repeat.
Required scope: webhooks:read.
query Parameters
limitcursorThe nextCursor of the previous page, with the same filters.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
List webhook endpoints › Responses
objecthasMorenextCursorCreate a webhook endpoint
Registers a URL that receives events. The response is the only time the signing secret is shown. An organization can have up to 16 webhook endpoints; the next one answers 422 webhook_endpoint_limit.
Required scope: webhooks:write.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Idempotency-KeyMakes the request safe to retry. Once it starts running, its final response (2xx, 4xx or 5xx) is kept for 24 hours and the same key gets it back, without repeating the effect. A request rejected before it runs leaves the key free. A replayed create omits the secret. The same key with a different request is rejected with 409 idempotency_key_reused.
Create a webhook endpoint › Request Body
urlPublic http(s) address that receives the events.
enabledEventsEvent types to receive, or "*" for all. See GET /v2/event-types.
descriptionapiVersionscopeself receives the events of this organization. customers receives the events of its subaccounts.
Create a webhook endpoint › Responses
objectidurldescriptionenabledEventsapiVersionscopestatusdisabledReasonWhy the system turned the endpoint off, when it did.
createdAtupdatedAtsecretSigning secret. It is shown only here; keep it. Verify with Lelemon-Signature.
previousSecretExpiresAtAfter a rotation, until when the previous secret still signs. Both signatures go in the header.
Retrieve a webhook endpoint
Returns one webhook endpoint by id. Use it to refresh a single record you already know; to find records, use the list route. Read only. 404 not_found when the id does not exist or belongs to another organization. You can repeat it safely: it has no side effects.
Required scope: webhooks:read.
path Parameters
id^whk_[0-9A-Za-z]{22}… · requiredThe id of the webhook endpoint (whk_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Retrieve a webhook endpoint › Responses
objectidurldescriptionenabledEventsapiVersionscopestatusdisabledReasonWhy the system turned the endpoint off, when it did.
createdAtupdatedAtDelete a webhook endpoint
Disables and removes a webhook endpoint. Events stop being sent to it right away. Deliveries already queued are not sent. The effect is permanent through the API. Repeating the call returns 404 not_found, because the endpoint no longer exists, so do not retry a 404 as a failure.
Required scope: webhooks:write.
path Parameters
id^whk_[0-9A-Za-z]{22}… · requiredThe id of the webhook endpoint (whk_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Delete a webhook endpoint › Responses
Update a webhook endpoint
Change the url, the events, the scope or the description. Send status: "enabled" to turn on an endpoint the system disabled.
Required scope: webhooks:write.
path Parameters
id^whk_[0-9A-Za-z]{22}… · requiredThe id of the webhook endpoint (whk_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Update a webhook endpoint › Request Body optional
urlenabledEventsdescriptionapiVersionscopestatusSet enabled to turn on an endpoint that was disabled.
Update a webhook endpoint › Responses
objectidurldescriptionenabledEventsapiVersionscopestatusdisabledReasonWhy the system turned the endpoint off, when it did.
createdAtupdatedAtRotate the signing secret
Returns a new secret. For 24 hours every event is signed with both: Lelemon-Signature carries two v1 values, so you can deploy the new secret without losing events. Every call rotates again and is not idempotent. Use dryRun=true to check the endpoint and see when the previous secret would stop working; nothing changes and the answer has no secret.
Required scope: webhooks:write.
path Parameters
id^whk_[0-9A-Za-z]{22}… · requiredThe id of the webhook endpoint (whk_…).
query Parameters
dryRunWhen true, the request goes through the same validation as the real one and is answered with what would happen (always 200), and nothing is saved, sent or charged. The answer has the same shape as the real one plus dryRun: true; an id in it is not saved. It does not use the Idempotency-Key.
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Idempotency-KeyMakes the request safe to retry. Once it starts running, its final response (2xx, 4xx or 5xx) is kept for 24 hours and the same key gets it back, without repeating the effect. A request rejected before it runs leaves the key free. A replayed create omits the secret. The same key with a different request is rejected with 409 idempotency_key_reused.
Rotate the signing secret › Responses
objectidurldescriptionenabledEventsapiVersionscopestatusdisabledReasonWhy the system turned the endpoint off, when it did.
createdAtupdatedAtpreviousSecretExpiresAtUntil when the previous secret still signs. Both signatures go in the header.
secretThe new signing secret. It is shown only here; keep it. Verify with Lelemon-Signature. Absent in a dryRun, which rotates nothing.
dryRunPresent and true when the request had dryRun=true.
Send a test event
Sends a webhook_endpoint.test event, signed like any other, to this endpoint only.
Required scope: webhooks:write.
path Parameters
id^whk_[0-9A-Za-z]{22}… · requiredThe id of the webhook endpoint (whk_…).
Headers
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
Idempotency-KeyMakes the request safe to retry. Once it starts running, its final response (2xx, 4xx or 5xx) is kept for 24 hours and the same key gets it back, without repeating the effect. A request rejected before it runs leaves the key free. A replayed create omits the secret. The same key with a different request is rejected with 409 idempotency_key_reused.
Send a test event › Responses
objectidtypeThe event type, such as case.escalated. See GET /v2/event-types.
createdAtorganizationIdThe shape depends on type. See GET /v2/event-types.
customerIdThe subaccount the event belongs to, when there is one.
List the deliveries of an endpoint
One row per attempt, newest first. Attempts are kept for 30 days.
Required scope: webhooks:read.
path Parameters
id^whk_[0-9A-Za-z]{22}… · requiredThe id of the webhook endpoint (whk_…).
query Parameters
limitcursorThe nextCursor of the previous page, with the same filters.
statusHeaders
Lelemon-Subaccount^sub_[0-9A-Za-z]{22}…The subaccount (sub_…) this request acts on. Only for the keys of a platform account; without it the request acts on the account itself.
List the deliveries of an endpoint › Responses
objecthasMorenextCursor