openapi: 3.2.0
info:
  title: Hookbase Webhook Endpoints API
  version: 1.0.0
  description: Official OpenAPI 3.0 specification for the Hookbase webhook relay platform. Generated from the maintained Postman collection. Authenticate with an API key (whr_ prefix) as a Bearer token.
  contact:
    name: Hookbase
    url: https://www.hookbase.app
servers:
- url: https://api.hookbase.app
  description: Production
security:
- bearerAuth: []
tags:
- name: Webhook Endpoints
paths:
  /api/webhook-endpoints:
    post:
      tags:
      - Webhook Endpoints
      summary: Create endpoint
      operationId: webhook_endpoints_create_endpoint
      responses:
        '200':
          description: Successful response
      description: Create a webhook endpoint (a delivery target) under an application.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                applicationId:
                  type: string
                  description: Required. Owning application id.
                url:
                  type: string
                  description: Required. Endpoint URL.
                description:
                  type: string
                  description: Optional. Freeform description (max 500).
                headers:
                  type: array
                  items:
                    type: object
                  description: Optional. Custom headers (max 10); each { name, value }.
                timeoutSeconds:
                  type: integer
                  description: Optional. Delivery timeout seconds (1–120, default 30).
                rateLimitPerSecond:
                  type: integer
                  description: Optional. Per-second rate limit (0–1000, 0 = unlimited).
                successStatusCodes:
                  type: array
                  items:
                    type: integer
                  description: Optional. Status codes treated as success (max 20; supports "2xx").
                backoffType:
                  type: string
                  description: Optional. exponential | linear | fixed.
                retryDelays:
                  type: array
                  items:
                    type: integer
                  description: Optional. Custom retry delays in seconds (max 10).
                ipAllowlistNotes:
                  type: string
                  description: Optional. Informational IP allowlist notes.
                useStaticIp:
                  type: boolean
                  description: Optional. Deliver from a dedicated static IP.
                circuitFailureThreshold:
                  type: integer
                  description: Optional. Failures to open the circuit (1–100).
                circuitSuccessThreshold:
                  type: integer
                  description: Optional. Successes to close the circuit (1–100).
                circuitCooldownSeconds:
                  type: integer
                  description: Optional. Circuit cooldown seconds (10–3600).
              required:
              - applicationId
              - url
            example:
              applicationId: '{{webhookApplicationId}}'
              url: https://acme.example.com/hooks
              description: Acme production endpoint
              headers:
              - name: X-Tenant
                value: acme
              timeoutSeconds: 30
              rateLimitPerSecond: 0
              successStatusCodes:
              - 200
              - 201
              - 2xx
              backoffType: exponential
              retryDelays:
              - 5
              - 30
              - 300
              ipAllowlistNotes: Allow 203.0.113.0/24
              useStaticIp: false
              circuitFailureThreshold: 5
              circuitSuccessThreshold: 2
              circuitCooldownSeconds: 60
    get:
      tags:
      - Webhook Endpoints
      summary: List endpoints
      operationId: webhook_endpoints_list_endpoints
      parameters:
      - name: applicationId
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
      description: List endpoints (filter by ?applicationId=).
  /api/webhook-endpoints/{webhookEndpointId}:
    get:
      tags:
      - Webhook Endpoints
      summary: Get endpoint by id
      operationId: webhook_endpoints_get_endpoint_by_id
      parameters:
      - name: webhookEndpointId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successful response
      description: Fetch a single endpoint.
    patch:
      tags:
      - Webhook Endpoints
      summary: Update endpoint
      operationId: webhook_endpoints_update_endpoint
      parameters:
      - name: webhookEndpointId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successful response
      description: Update an endpoint. All fields optional.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                url:
                  type: string
                  description: Optional. Endpoint URL.
                description:
                  type: string
                  description: Optional. Description (null to clear).
                isDisabled:
                  type: boolean
                  description: Optional. Disable the endpoint.
                disabledReason:
                  type: string
                  description: Optional. Reason when disabled (max 500).
                headers:
                  type: array
                  items:
                    type: object
                  description: Optional. Custom headers (max 10); each { name, value }.
                timeoutSeconds:
                  type: integer
                  description: Optional. Delivery timeout seconds (1–120, default 30).
                rateLimitPerSecond:
                  type: integer
                  description: Optional. Per-second rate limit (0–1000, 0 = unlimited).
                successStatusCodes:
                  type: array
                  items:
                    type: integer
                  description: Optional. Status codes treated as success (max 20; supports "2xx").
                backoffType:
                  type: string
                  description: Optional. exponential | linear | fixed.
                retryDelays:
                  type: array
                  items:
                    type: integer
                  description: Optional. Custom retry delays in seconds (max 10).
                ipAllowlistNotes:
                  type: string
                  description: Optional. Informational IP allowlist notes.
                useStaticIp:
                  type: boolean
                  description: Optional. Deliver from a dedicated static IP.
                circuitFailureThreshold:
                  type: integer
                  description: Optional. Failures to open the circuit (1–100).
                circuitSuccessThreshold:
                  type: integer
                  description: Optional. Successes to close the circuit (1–100).
                circuitCooldownSeconds:
                  type: integer
                  description: Optional. Circuit cooldown seconds (10–3600).
            example:
              url: https://acme.example.com/hooks
              description: Updated description
              isDisabled: false
              disabledReason: Customer paused
              headers:
              - name: X-Tenant
                value: acme
              timeoutSeconds: 30
              rateLimitPerSecond: 0
              successStatusCodes:
              - 200
              - 201
              - 2xx
              backoffType: exponential
              retryDelays:
              - 5
              - 30
              - 300
              ipAllowlistNotes: Allow 203.0.113.0/24
              useStaticIp: false
              circuitFailureThreshold: 5
              circuitSuccessThreshold: 2
              circuitCooldownSeconds: 60
  /api/webhook-endpoints/{webhookEndpointId}/reset-circuit:
    post:
      tags:
      - Webhook Endpoints
      summary: Reset endpoint circuit
      operationId: webhook_endpoints_reset_endpoint_circuit
      parameters:
      - name: webhookEndpointId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successful response
      description: Force the endpoint's circuit breaker back to closed.
  /api/webhook-endpoints/{webhookEndpointId}/rotate-secret:
    post:
      tags:
      - Webhook Endpoints
      summary: Rotate endpoint secret
      operationId: webhook_endpoints_rotate_endpoint_secret
      parameters:
      - name: webhookEndpointId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successful response
      description: Rotate the endpoint's signing secret, keeping the old one valid for a grace period.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                gracePeriodSeconds:
                  type: integer
                  description: Optional. Seconds the old secret stays valid (0–86400, default 3600).
            example:
              gracePeriodSeconds: 3600
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Hookbase API key with the whr_ prefix.