HL HuntHL HuntDocs
Dashboard
Browse documentation

WEBHOOKS

Webhook Endpoints

Register HTTPS destinations for the event stream. The signing secret is returned exactly once on create and rotate.

POST/webhook-endpointswebhooks:manage

Register a destination (HTTPS, port 443, public hosts only). event_types empty = all events.

Request body

{
  "url": "https://example.com/hooks",
  "event_types": [
    "payment.succeeded",
    "case.closed"
  ]
}

Response

{
  "object": "webhook_endpoint",
  "id": "…",
  "secret": "whsec_… (shown once)",
  "status": "enabled"
}

Example

curl https://debt.hlhunt.org/api/v1/webhook-endpoints \
  -H "Authorization: Bearer hlh_live_..." \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com/hooks", "event_types": [ "payment.succeeded", "case.closed" ] }'
GET/webhook-endpointswebhooks:manage

List endpoints (secret_last4 only — the secret is never readable).

Response

{
  "object": "list",
  "data": [
    {
      "id": "…",
      "url": "https://…",
      "secret_last4": "ab12"
    }
  ]
}

Example

curl https://debt.hlhunt.org/api/v1/webhook-endpoints \
  -H "Authorization: Bearer hlh_live_..."
GET/webhook-endpoints/{id}webhooks:manage

Retrieve one endpoint (secret_last4 only).

Response

{
  "object": "webhook_endpoint",
  "id": "…",
  "url": "https://…",
  "status": "enabled",
  "secret_last4": "ab12"
}

Example

curl https://debt.hlhunt.org/api/v1/webhook-endpoints/ID \
  -H "Authorization: Bearer hlh_live_..."
PATCH/webhook-endpoints/{id}webhooks:manage

Update url, description, event_types, or status (enabled/disabled).

Request body

{
  "status": "disabled"
}

Response

{
  "object": "webhook_endpoint",
  "id": "…",
  "status": "disabled"
}

Example

curl https://debt.hlhunt.org/api/v1/webhook-endpoints/ID \
  -H "Authorization: Bearer hlh_live_..." \
  -X PATCH \
  -H "Content-Type: application/json" \
  -d '{ "status": "disabled" }'
DELETE/webhook-endpoints/{id}webhooks:manage

Soft-delete the endpoint and cancel its pending deliveries.

Response

{
  "object": "webhook_endpoint",
  "id": "…",
  "deleted": true
}

Example

curl https://debt.hlhunt.org/api/v1/webhook-endpoints/ID \
  -H "Authorization: Bearer hlh_live_..." \
  -X DELETE
POST/webhook-endpoints/{id}/rotate-secretwebhooks:manage

Rotate the signing secret (returned once). The previous secret keeps verifying for 24 hours.

Response

{
  "object": "webhook_endpoint",
  "id": "…",
  "secret": "whsec_… (shown once)"
}

Example

curl https://debt.hlhunt.org/api/v1/webhook-endpoints/ID/rotate-secret \
  -H "Authorization: Bearer hlh_live_..." \
  -X POST