API reference

Webhooks

Endpoints that receive events, their deliveries and their secrets.

On this page

List webhook endpoints
Register an endpoint
Change or pause an endpoint
Remove an endpoint
Send a test ping
The endpoint's last 25 deliveries
Rotate the signing secret

Base address https://api.stillmoregroup.com/api/v1. Every answer is JSON; errors have one shape.

Endpoint	What it does
`GET /webhooks`	List webhook endpoints
`POST /webhooks`	Register an endpoint
`PATCH /webhooks/{webhookId}`	Change or pause an endpoint
`DELETE /webhooks/{webhookId}`	Remove an endpoint
`POST /webhooks/{webhookId}/test`	Send a test ping
`GET /webhooks/{webhookId}/deliveries`	The endpoint's last 25 deliveries
`POST /webhooks/{webhookId}/rotate-secret`	Rotate the signing secret

List webhook endpoints#

GET /webhooks · scope webhooks:manage

Headers#

Stillmore-Organization: A sub-label to act for, when the key may (see Sub-labels).

Example request#

curl "https://api.stillmoregroup.com/api/v1/webhooks" \
  -H "Authorization: Bearer $STILLMORE_API_KEY"

Response 200#

A page: data holds the items below, hasMore says whether another page follows, and nextCursor is the cursor for it.

idstring
urlstring
descriptionstring or null
eventsstring[]
activeboolean
lastDeliveryAtstring or null
lastDeliveryStatusstring or null: One of DELIVERED, FAILED.
previousSecretExpiresAtstring or null
createdAtstring

Example response

{
  "data": [
    {
      "id": "6731c2a1b3c4d5e6f7a8b9c0",
      "url": "https://example.com/webhooks/stillmore",
      "description": "Sent from our catalogue system",
      "events": [
        "…"
      ],
      "active": true,
      "lastDeliveryAt": "2026-11-01T09:30:00.000Z",
      "lastDeliveryStatus": "DELIVERED",
      "previousSecretExpiresAt": "2026-11-01T09:30:00.000Z",
      "createdAt": "2026-11-01T09:30:00.000Z"
    }
  ],
  "hasMore": false,
  "nextCursor": null
}

Register an endpoint#

POST /webhooks · scope webhooks:manage

Up to ten https endpoints. The answer shows the signing secret once.

Body#

urlstringRequired: Up to 2000 characters.
descriptionstring: Up to 160 characters.
events"*"[] or string[]: Event names, or [""] for every event. Default `[""]`.

Headers#

Idempotency-Key: Any unique value, such as a UUID: a retry with the same key and body gets the first answer again for 24 hours.
Stillmore-Organization: A sub-label to act for, when the key may (see Sub-labels).

Example request#

curl -X POST "https://api.stillmoregroup.com/api/v1/webhooks" \
  -H "Authorization: Bearer $STILLMORE_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/webhooks/stillmore",
    "description": "Sent from our catalogue system"
  }'

Response 201#

data holds the object below.

webhookobject
webhook.idstring
webhook.urlstring
webhook.descriptionstring or null
webhook.eventsstring[]
webhook.activeboolean
webhook.lastDeliveryAtstring or null
webhook.lastDeliveryStatusstring or null: One of DELIVERED, FAILED.
webhook.previousSecretExpiresAtstring or null
webhook.createdAtstring
secretstring: Shown once.

Example response

{
  "data": {
    "webhook": {
      "id": "6731c2a1b3c4d5e6f7a8b9c0",
      "url": "https://example.com/webhooks/stillmore",
      "description": "Sent from our catalogue system",
      "events": [
        "…"
      ],
      "active": true,
      "lastDeliveryAt": "2026-11-01T09:30:00.000Z",
      "lastDeliveryStatus": "DELIVERED",
      "previousSecretExpiresAt": "2026-11-01T09:30:00.000Z",
      "createdAt": "2026-11-01T09:30:00.000Z"
    },
    "secret": "whsec_…"
  }
}

Errors#

Code	What it means
`WEBHOOK_LIMIT`	From the workspace rule behind this endpoint; `message` says what to change.

Every endpoint can also give the errors every call can give, such as VALIDATION_ERROR, INSUFFICIENT_SCOPE and RATE_LIMITED.

Change or pause an endpoint#

PATCH /webhooks/{webhookId} · scope webhooks:manage

Path parameters#

webhookIdstring: An id.

Body#

urlstring: Up to 2000 characters.
descriptionstring or null: Up to 160 characters.
events"*"[] or string[]: Event names, or ["*"] for every event.
activeboolean: false stops deliveries to the endpoint until it is set back to true.

Headers#

Idempotency-Key: Any unique value, such as a UUID: a retry with the same key and body gets the first answer again for 24 hours.
If-Match: The revision you read; when the object changed since, the answer is 412 REVISION_MISMATCH.
Stillmore-Organization: A sub-label to act for, when the key may (see Sub-labels).

Example request#

curl -X PATCH "https://api.stillmoregroup.com/api/v1/webhooks/{webhookId}" \
  -H "Authorization: Bearer $STILLMORE_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Sent from our catalogue system"
  }'

Response 200#

data holds the object below.

idstring
urlstring
descriptionstring or null
eventsstring[]
activeboolean
lastDeliveryAtstring or null
lastDeliveryStatusstring or null: One of DELIVERED, FAILED.
previousSecretExpiresAtstring or null
createdAtstring

Example response

{
  "data": {
    "id": "6731c2a1b3c4d5e6f7a8b9c0",
    "url": "https://example.com/webhooks/stillmore",
    "description": "Sent from our catalogue system",
    "events": [
      "…"
    ],
    "active": true,
    "lastDeliveryAt": "2026-11-01T09:30:00.000Z",
    "lastDeliveryStatus": "DELIVERED",
    "previousSecretExpiresAt": "2026-11-01T09:30:00.000Z",
    "createdAt": "2026-11-01T09:30:00.000Z"
  }
}

Errors#

Code	What it means
`WEBHOOK_NOT_FOUND`	From the workspace rule behind this endpoint; `message` says what to change.

Every endpoint can also give the errors every call can give, such as VALIDATION_ERROR, INSUFFICIENT_SCOPE and RATE_LIMITED.

Remove an endpoint#

DELETE /webhooks/{webhookId} · scope webhooks:manage

Path parameters#

webhookIdstring: An id.

Headers#

Stillmore-Organization: A sub-label to act for, when the key may (see Sub-labels).

Example request#

curl -X DELETE "https://api.stillmoregroup.com/api/v1/webhooks/{webhookId}" \
  -H "Authorization: Bearer $STILLMORE_API_KEY"

Response 200#

data holds the object below.

deletedtrue

Example response

{
  "data": {
    "deleted": true
  }
}

Errors#

Code	What it means
`WEBHOOK_NOT_FOUND`	From the workspace rule behind this endpoint; `message` says what to change.

Every endpoint can also give the errors every call can give, such as VALIDATION_ERROR, INSUFFICIENT_SCOPE and RATE_LIMITED.

Send a test ping#

POST /webhooks/{webhookId}/test · scope webhooks:manage

Path parameters#

webhookIdstring: An id.

Headers#

Idempotency-Key: Any unique value, such as a UUID: a retry with the same key and body gets the first answer again for 24 hours.
Stillmore-Organization: A sub-label to act for, when the key may (see Sub-labels).

Example request#

curl -X POST "https://api.stillmoregroup.com/api/v1/webhooks/{webhookId}/test" \
  -H "Authorization: Bearer $STILLMORE_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 200#

data holds the object below.

idstring
eventstring
statusstring: One of PENDING, DELIVERED, FAILED.
attemptsinteger: From -9007199254740991 to 9007199254740991.
responseStatusnumber or null
errorstring or null
deliveredAtstring or null
createdAtstring

Example response

{
  "data": {
    "id": "6731c2a1b3c4d5e6f7a8b9c0",
    "event": "…",
    "status": "PENDING",
    "attempts": 1,
    "responseStatus": 1,
    "error": "…",
    "deliveredAt": "2026-11-01T09:30:00.000Z",
    "createdAt": "2026-11-01T09:30:00.000Z"
  }
}

Errors#

Code	What it means
`WEBHOOK_NOT_FOUND`	From the workspace rule behind this endpoint; `message` says what to change.

Every endpoint can also give the errors every call can give, such as VALIDATION_ERROR, INSUFFICIENT_SCOPE and RATE_LIMITED.

The endpoint's last 25 deliveries#

GET /webhooks/{webhookId}/deliveries · scope webhooks:manage

Path parameters#

webhookIdstring: An id.

Headers#

Stillmore-Organization: A sub-label to act for, when the key may (see Sub-labels).

Example request#

curl "https://api.stillmoregroup.com/api/v1/webhooks/{webhookId}/deliveries" \
  -H "Authorization: Bearer $STILLMORE_API_KEY"

Response 200#

A page: data holds the items below, hasMore says whether another page follows, and nextCursor is the cursor for it.

idstring
eventstring
statusstring: One of PENDING, DELIVERED, FAILED.
attemptsinteger: From -9007199254740991 to 9007199254740991.
responseStatusnumber or null
errorstring or null
deliveredAtstring or null
createdAtstring

Example response

{
  "data": [
    {
      "id": "6731c2a1b3c4d5e6f7a8b9c0",
      "event": "…",
      "status": "PENDING",
      "attempts": 1,
      "responseStatus": 1,
      "error": "…",
      "deliveredAt": "2026-11-01T09:30:00.000Z",
      "createdAt": "2026-11-01T09:30:00.000Z"
    }
  ],
  "hasMore": false,
  "nextCursor": null
}

Errors#

Code	What it means
`WEBHOOK_NOT_FOUND`	From the workspace rule behind this endpoint; `message` says what to change.

Every endpoint can also give the errors every call can give, such as VALIDATION_ERROR, INSUFFICIENT_SCOPE and RATE_LIMITED.

Rotate the signing secret#

POST /webhooks/{webhookId}/rotate-secret · scope webhooks:manage

A new secret, shown once. The old one keeps signing alongside it (two v1= signatures) for graceHours, 24 by default.

Path parameters#

webhookIdstring: An id.

Body#

graceHoursinteger: From 0 to 72. Default 24.

Headers#

Idempotency-Key: Any unique value, such as a UUID: a retry with the same key and body gets the first answer again for 24 hours.
Stillmore-Organization: A sub-label to act for, when the key may (see Sub-labels).

Example request#

curl -X POST "https://api.stillmoregroup.com/api/v1/webhooks/{webhookId}/rotate-secret" \
  -H "Authorization: Bearer $STILLMORE_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{}'

Response 200#

data holds the object below.

webhookobject
webhook.idstring
webhook.urlstring
webhook.descriptionstring or null
webhook.eventsstring[]
webhook.activeboolean
webhook.lastDeliveryAtstring or null
webhook.lastDeliveryStatusstring or null: One of DELIVERED, FAILED.
webhook.previousSecretExpiresAtstring or null
webhook.createdAtstring
secretstring: Shown once.

Example response

{
  "data": {
    "webhook": {
      "id": "6731c2a1b3c4d5e6f7a8b9c0",
      "url": "https://example.com/webhooks/stillmore",
      "description": "Sent from our catalogue system",
      "events": [
        "…"
      ],
      "active": true,
      "lastDeliveryAt": "2026-11-01T09:30:00.000Z",
      "lastDeliveryStatus": "DELIVERED",
      "previousSecretExpiresAt": "2026-11-01T09:30:00.000Z",
      "createdAt": "2026-11-01T09:30:00.000Z"
    },
    "secret": "whsec_…"
  }
}

Errors#

Code	What it means
`WEBHOOK_NOT_FOUND`	From the workspace rule behind this endpoint; `message` says what to change.

Every endpoint can also give the errors every call can give, such as VALIDATION_ERROR, INSUFFICIENT_SCOPE and RATE_LIMITED.