# HookDeploy

HookDeploy is webhook infrastructure for developers — capture, inspect, transform, route, and replay webhooks at Cloudflare's edge in under 100ms.

## What it does
- Captures incoming webhooks at a unique URL (under 100ms edge capture)
- Shows full payload, headers, query params in real time
- Forwards webhooks to one or more destinations in parallel
- Transforms payloads before forwarding with a visual editor (Starter+)
- Lets you replay captured requests to any HTTPS URL
- Correlates forward failures into incidents with status, updates, and paced bulk replay (replay is Starter+)
- Delivers to private infrastructure via the source-available HookDeploy Agent dialing out over mTLS — no public IP, no open port (Starter+)
- Provides a REST API at api.hookdeploy.dev

## Features
- Multiple forward destinations per endpoint (1 on Free, up to 5 on Starter, unlimited on Pro and above)
- Visual payload transformation editor (rename fields, strip PII, format values)
- 23 built-in formatters: cents_to_dollars, mask, hash, unix_to_iso, and more
- Header injection per destination for authentication

## Security (Starter and above)

Endpoint security features:
- IP allowlist: restrict requests to specific IPs or CIDR ranges
  Pre-configured ranges for Stripe, GitHub, Shopify, Twilio
  Custom IPs and CIDR ranges supported
  Blocked requests logged with source IP and reason

- Secret token authentication: require X-HookDeploy-Token header or ?token= param
  Tokens prefixed hd_ep_, stored as SHA-256 hash
  Invalid requests get 401, logged as blocked attempts

- 16-character endpoint slugs on every plan

- Blocked requests dashboard: view all blocked attempts per endpoint
  Separate tab in endpoint detail, real-time updates

Payload sanitization (all plans, on by default):
- Auth headers automatically redacted before R2 storage
- Redacted headers: Authorization, Cookie, X-Api-Key, X-Auth-Token, etc.
- HMAC signatures never redacted: X-Stripe-Signature, X-Hub-Signature-256, etc.
- Forwarding uses original headers (sanitization is storage-only)
- Disabling requires Starter+, warning acknowledgement recorded in audit log
- Body key sanitization: Starter+, custom field names configurable
- Redacted values shown as [redacted] in dashboard

- Real-time webhook inspection and one-click replay
- Team collaboration with role-based access

## HTTP Cron Jobs

Schedule HTTP requests to any URL on a recurring schedule.

Features:
- Any cron expression (5-field standard format)
- Timezone-aware scheduling (IANA timezone strings)
- 30-second request timeout
- Full response body stored per run (first 10KB)
- Slack failure notifications (uses org Slack connection)
- Auto-disable after 10 consecutive failures
- Email notification on each failure and on auto-disable
- Manual "Run now" trigger
- Realtime run history in dashboard

Plan limits:
- Free: 2 jobs, 1 hour minimum interval
- Starter: 10 jobs, 5 minute minimum interval
- Pro: 50 jobs, 1 minute minimum interval
- Scale: 50 jobs, 1 minute minimum interval
- Enterprise: unlimited, 1 minute minimum

API:
- POST /v1/cron-jobs — create
- POST /v1/cron-jobs/:id/trigger — manual run
- GET /v1/cron-jobs/:id/runs — run history

## Pricing
- Free: 1 user, 5 endpoints, 10,000 requests/month, 1GB storage/month, 1 forward destination, 0 production agents — no transformations or header injection
- Starter: 25,000 requests/month included, then $0.30 per 1,000
- Pro: 150,000 requests/month included, then $0.25 per 1,000
- Scale: 500,000 requests/month included, then $0.20 per 1,000
- Enterprise: custom pricing — 10 production agents (hard cap, no overage), unlimited users and endpoints, custom terms
- Development agents: unlimited on every plan including Free, with fail-fast (no-retry) delivery
- Free rejects requests beyond its monthly allowance with HTTP 429. Paid self-serve plans accept traffic beyond the included volume and bill overage per 1,000 requests. At the storage cap, webhooks are still accepted and forwarded, but new payload bodies are not stored.

## Documentation
https://hookdeploy.dev/docs

## API
https://hookdeploy.dev/docs/api/overview
Base URL: https://api.hookdeploy.dev/v1
Auth: Bearer token (API key from dashboard)

### Incidents API
https://hookdeploy.dev/docs/api/incidents
https://hookdeploy.dev/docs/concepts/incidents

- Incidents correlate forward failures by destination or provider ASN (30-minute window)
- Statuses: open, investigating, resolved
- Recurrence within 14 days links previous_incident_id
- GET /v1/incidents — list (status filter: open|investigating|resolved|all)
- GET /v1/incidents/:id — detail with failures + updates
- PATCH /v1/incidents/:id — update status
- POST /v1/incidents/:id/replay — paced bulk replay (requests_per_minute required; Starter+; 12h max batch)
- Incident create/view/resolve: no plan gate; bulk replay: Starter+

### Destinations API
https://hookdeploy.dev/docs/api/destinations

- POST /v1/destinations — default (https): create saved HTTPS destination; optional endpoint_id attach (attachment_error if attach fails). destination_type=agent: create agent forward destination directly (requires endpoint_id, agent_id, target_port, target_path; agents.assign_destination permission; no saved-destination record)
- GET /v1/destinations — list saved HTTPS destinations only (agent targets are not reusable templates)
- GET /v1/destinations/:id — detail with linked endpoints
- GET /v1/endpoints/:id/destinations — forward destinations on an endpoint (includes destination_type, agent_id, target_port, target_path; null for https)
- Agent forward_results use destination_url agent://{agent_id}:{port}{path}; same status_code/response_time_ms/error shape as HTTPS

### Incident subscriptions
https://hookdeploy.dev/docs/api/incident-subscriptions

- POST/GET/DELETE /v1/incident-subscriptions
- Events: incident.created, incident.investigating, incident.resolved
- Delivery headers: x-hookdeploy-event, x-hookdeploy-subscription-id, x-hookdeploy-delivery-timestamp

### Member management API

POST /v1/members/invite — invite a member by email with role specification
Body: { email, role }
Roles: super_admin, admin, developer, viewer, finance
Returns: { id, email, role, expires_at, accept_url }
Requires: admin or super_admin API key

POST /v1/members/deactivate — immediately revoke a member's access
Body: { email }
Returns: { success, email, role, active: false }
Preserves data and history, can be reactivated without new invite
Requires: admin or super_admin API key

POST /v1/members/reactivate — restore a deactivated member's access
Body: { email }
Returns: { success, email, role, active: true }
Restores original role immediately, no new invite needed
Requires: admin or super_admin API key

Permission rules:
- super_admin: can manage all members except org owner
- admin: can manage developer/viewer/finance, not super_admin/owner
- developer/viewer/finance: no member management access
- Cannot deactivate yourself
- Cannot deactivate the organization owner

## Integrations

Slack (native OAuth integration):
- Connect Slack workspace via OAuth in Org Settings → Notifications
- Notifications for webhook capture, forward success, and forward failure
- Configurable channels per event type
- Per-endpoint channel overrides (Starter+)
- Per-destination failure channel overrides (Pro+)
- @channel / @here mentions on failures
- Body preview in messages
- Replay button directly in Slack failure messages
- Available on Starter and above

Zapier (native REST Hook integration; beta invite via HookDeploy dashboard):
https://hookdeploy.dev/integrations/zapier
Triggers:
- New Webhook Received, Forwarding Succeeded, Forwarding Failed
- New Incident, Incident Investigating, Incident Resolved
Actions:
- Create / Pause / Resume Endpoint
- List Endpoints, List Requests, Get Request, Replay Request
- Invite / Deactivate / Reactivate Member
- Update Incident Status, Replay Incident, Create Destination

n8n (verified community node on n8n Cloud; also self-hosted via npm):
https://hookdeploy.dev/integrations/n8n
Package: n8n-nodes-hookdeploy
Triggers:
- New Webhook Received, Forwarding Succeeded, Forwarding Failed
- Incident Created, Incident Investigating, Incident Resolved
Actions (resource groups):
- Endpoint: Create, List, Pause, Resume
- Request: List, Get, Replay
- Incident: List, Get, Update Status, Replay
- Destination: Create, List, Get
- Member: Invite / Deactivate / Reactivate