Webhook endpoints

Tell WhatIsUp.dev where to deliver event notifications. One customer can have multiple endpoints (different URLs for different event subsets). One instance can be the source of events for multiple endpoints, and one endpoint can subscribe to multiple instances — they're a many-to-many.

Conceptual model

Endpoints describe a subscription: where to send, which events to send, and the signing secret used for the HMAC. The actual delivery records are in Webhook deliveries.

api_key → customer ──┬── instance ◄───┐
                     │                 │
                     └── webhook_endpoint
                              │
                              └── webhook_delivery (per event)

List endpoints

Returns every endpoint owned by the authenticated customer.

Create an endpoint

curl -sX POST "$WHATISUP_API/v1/webhook-endpoints" \
  -H "Authorization: Bearer $WHATISUP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://api.acme.dev/whatisup/webhook","events":["message.received","message.sent"],"instance_ids":["inst_01J..."]}'

The response includes the signing secret in plaintext — only on this one call. Store it; we never show it again. (We can rotate it; we cannot recover it.)

Update an endpoint

You can rotate the signing secret by passing rotate_secret: true. The new secret is returned in the response body, exactly once. Old secret is invalidated immediately — verify the rollout before flipping it.

Delete an endpoint

Returns 204 No Content. In-flight deliveries (already in BullMQ) for this endpoint will fail to a non-existent target and exhaust their retry budget. If you need a hard stop, pause the queue first.