Create a webhook

post

https://api.clc.solutions/v1/webhooks

Requires scope webhook:write.

Returns the id and nothing else. The signing secret is not per-webhook.
it is one secret for your whole tenant, created separately with
POST /v1/webhooks/secrets.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

url

uri

required

HTTPS only

event_types

array of objects

length ≥ 1

Omit this to receive every event type, including ones CLC adds later. Send it and you receive only what you list, so a type introduced after you registered will not arrive until you add it. An empty array is rejected rather than read as "everything": that is almost always a client that built a list and came up empty.

event_types

label

string

required

length between 5 and 30

^[A-Za-z0-9 -]+$

A name of your own, so you can tell your webhooks apart. Letters, digits, spaces and hyphens only, 5 to 30 characters.

Headers

Idempotency-Key

string

required

length ≤ 255

Required on every mutation. Unique per (tenant, key). Stored 24 h; a replay returns the original response with Idempotent-Replay: true.

X-CLC-Timestamp

string

required

^[0-9]{10}$

Unix seconds. Requests outside a ±5 minute window are rejected, and the value is part of the signed canonical request.

X-CLC-Signature

string

required

length between 88 and 88

^[A-Za-z0-9+/]{86}==$

Base64 of the Ed25519 signature over the canonical request. Ed25519 signatures are always 64 bytes, so this is always 88 characters ending in ==.

Response

201Webhook registered