Graphon Engine

Create webhook

Register a webhook that receives the signed status events of a cluster, namespace, or collection scope.

POST/webhooks

PermissionCluster key, or a scoped key with write on every collection that the webhook covers. Key scopes and actions.

  • The answer holds secret, once. Store it before you continue. Later reads show only signing.secret_fingerprint.
  • Create takes no Idempotency-Key, because its answer holds a secret. A retry with the same name returns already_exists. Rotate the secret to get a new one.
  • Engine sends no POST at create, so the receiver need not be up. Call Test webhook to check it. The webhook gets only the events that occur after its create. Replay fills the past.
  • A namespace key can create namespace and collection webhooks in its own namespace. A collection key can create collection webhooks for its own collections. Only a cluster key can create a cluster webhook or list more than one namespace.
  • The URL must use https, hold no user info or fragment, and resolve only to public addresses.

Request body

enabledbooleanoptional

Whether Engine queues and sends events. Default true. A webhook created with false has disabled_reason requested.

Default: true

namestringrequired

Webhook name. Use 1–63 lowercase letters, digits, underscores, or hyphens. Start with a letter or digit. Unique in the cluster. It never changes, and each POST sends it in X-Graphon-Events-Webhook.

scopeobjectrequired

Which events the webhook gets and which keys manage it: a cluster, namespace, or collection scope. Every namespace and collection must exist and be inside the key’s scope.

typesarray<string>optionalaccepts null

Event types to send. Null or omitted sends every type, also types added later. Otherwise a nonempty list of event types.

urlstringrequired

Receiver URL. Use https, with no user info and no fragment. A query string and any port are allowed. Every address that the host resolves to must be public. Keys with read can see the URL, so do not put a credential in it.

Responses

201Webhook created

The new webhook. secret appears only in this response.

application/json

Response headers

x-engine-request-idstringrequired

The Engine request ID. Retain it when investigating a failed or unexpected request.

x-request-idstringrequired

The X-Request-Id you sent, echoed when it is a valid ID. Otherwise, the Engine request ID.

Locationstringrequired

The path of the new resource, by ids.

created_atstring (date-time)required

Time the resource was created, as an ISO 8601 UTC timestamp.

deliveryobjectrequired

Delivery summary: pending events and the times of the last success and failure.

disabled_reasonstringrequiredaccepts null

Why the webhook is off: requested (a key set enabled false) or failing (Engine turned it off). Null while it is on.

requested
A key set enabled to false.
failing
Engine turned the webhook off: the receiver answered 410, or sent no 2xx for 72 hours.
enabledbooleanrequired

Whether Engine queues and sends events.

idstringrequired

Immutable webhook ID with the whk_ prefix.

namestringrequired

Webhook name. It never changes. Each POST sends it in X-Graphon-Events-Webhook.

scopeobjectrequired

The webhook’s scope. A namespace or collection key sees only its own namespace and collections in it.

secretstringoptionalaccepts null

The signing secret: whsec_ and the base64 of 32 random bytes. Only the answers to Create and Rotate hold it. Store it before you continue.

signingobjectrequired

Fingerprints that identify the signing secrets, and the end of a rotation overlap.

typesarray<string>requiredaccepts null

Event types that the webhook gets. Null means every type, also types added later.

updated_atstring (date-time)required

Time the resource last changed, as an ISO 8601 UTC timestamp.

urlstringrequired

Receiver URL that Engine POSTs to.

Errors

Select an error in the response example to see its JSON body. See error handling for the common error format.

400invalid_request

A field, path, parameter, or conditional request rule is invalid.

What to do: Correct the request. Unknown fields are rejected.

401unauthenticated

The API key is missing, invalid, or revoked.

What to do: Send an active key in Authorization: Bearer or X-API-Key.

403forbidden

The key can see the resource but lacks permission for this operation.

What to do: Use a key with the required action or scope kind.

404not_found

The resource is absent, deleted, or outside this key’s scope.

What to do: Check the identifier and the key’s namespace and collection scope.

409already_exists

The requested resource name already exists.

What to do: Use a new name. Namespace and collection creation also accept exist_ok to return an existing resource.

413request_too_large

The JSON body exceeds the route limit: 6,291,456 bytes on :answer and research, 4,194,304 bytes on :search and :read-spans, and 1,048,576 bytes elsewhere.

What to do: Reduce the JSON body. Use upload or a URI source for larger file content.

503temporarily_unavailable

A dependency, cluster readiness condition, or capacity limit prevents this operation.

What to do: Inspect retryable and details. Retry only when permitted, preserving the idempotency key for the same write.

500internal_error

An unexpected server failure prevented this request from completing.

What to do: Retain request_id for investigation. Follow retryable before retrying a write.

Was this page helpful?
View as Markdown