Skip to main content
POST
Create a webhook

Authorizations

Authorization
string
header
required

An organization-scoped API key, minted in control under Settings → API keys. Every failure to authenticate answers one identical 401: "Provide a valid organization-scoped API key or an active session." Each operation names the one scope it is filed under, <resource>:<read|write>, where the resource is the first path segment after /api/v1/; a key minted today carries all 22 of them. Scopes are RECORDED — on the key and on every audit row — and are not yet enforced: no request is refused for want of one.

Headers

Idempotency-Key
string

Any unique string.

Body

application/json
workerId
string
required

The Worker whose agent takes each delivery's turn. Resolved under your organization.

name
string
required

What this endpoint is called. 1–120 characters; the agent is told a delivery came from it.

surfaceKind
enum<string>
required

A room, or a direct message with one person.

Available options:
channel,
dm
description
string

Free text for whoever maintains it. 500 characters or fewer.

channelId
string

Required on channel. A channel already mapped to this Worker — an unmapped room, and a DM id, are both refused.

slackUserId
string

Required on dm. The person the worker sends each result to.

threading
enum<string>

Sets the run settings: same_thread keeps memory and runs events one at a time; the others overlap with a fresh conversation each. Absent is top_level.

Available options:
top_level,
new_thread,
same_thread
rootText
string

Unused: stored, and nothing reads it. 500 characters or fewer.

promptTemplate
string

What the agent is asked to do. 4000 characters or fewer. The payload is appended below it, or placed at {{payload}} when the template names that.

secretKind
enum<string>

header (absent) mints a whsec_… secret the sender puts in Authorization: Bearer. link mints a whlnk_… secret carried in the URL, for a sender that takes only a web address (Calendly, Cal.com), and answers link beside secret. A rotate without link turns a link webhook into a header one.

Available options:
header,
link

Required, and true, with secretKind: "link": you accept that the tool you paste the link into keeps a copy of it, and that a link carrying a secret is less safe than a secret sent in a header. Without it the call is a 400 and nothing is changed.

Response

Success.

data
object
required