Create a webhook endpoint
Events from now on go to it, of the profiles the person it sends for reaches (onBehalfOf: the caller, or the person behind the API key or agent), and it is deleted when they leave the team. Each event goes as one POST of JSON (the event as List events gives it), signed with Standard Webhooks' headers (webhook-id, the event's id; webhook-timestamp; webhook-signature). A 2xx answer within 15 seconds is delivered; anything else is tried again 6 times over about 18 hours, and a 410 Gone disables the endpoint. After 10 failures in a row an endpoint's deliveries wait while one at a time tries it, and one that keeps failing like that with nothing delivered for 5 days is disabled; Rizamo emails the team's owners and the person it sends for. Never sent to rizamo.com or workers.dev addresses, nor to private ones. Deliveries are not in order: order one resource's events by at. Its signing secret is in the answer, and only there. A team has up to 20 endpoints.
apiKeyAuthorizationBearer <token>An API key from the web app, under Developers. It starts with rz_live_.
Idempotency-Key?string1 to 255 printable characters, new for each request (a UUID); the body up to 1 MB. For 24 hours a repeat with the same key, path and body gets the first answer, with Idempotent-Replayed: true, instead of running again; 5xx, 409 and 429 answers are not kept. Errors, Retries, has the rest.
1 <= length <= 255application/json- body
url*stringWhere Rizamo sends events: an https address on the public internet.
1 <= length <= 2048description?stringWhat it is for, for the people of the team.
length <= 200""events?array<>|The event types it receives. Null: every type, those Rizamo adds later included. A key or agent lists the inbox's types (comment.received, message.received, message.sent) only with inbox:read, and comment_automation.* only with automations:read; with null, the endpoint gets none of those it cannot read.
nullprofileIds?array<>|Only events of these profiles. Null: every profile's, and the events of no profile. Someone limited to some profiles gives some of theirs.
nullOK
application/json- response
endpoint*secret*stringThe signing secret (whsec_ and base64), shown only now: keep it where your receiver reads it. Each delivery's webhook-signature is v1, and the base64 HMAC-SHA256, keyed with the base64 after whsec_, of <webhook-id>.<webhook-timestamp>.<body>.
curl -X POST 'https://api.rizamo.com/v1/webhooks' \ -H 'Idempotency-Key: 4b9e7c1a-2f3d-4e8a-9c6b-1d2e3f4a5b6c' \ -H 'Content-Type: application/json' \ -d '{ "url": "https://hooks.cafelumen.pt/rizamo", "description": "Posts to our CRM", "events": [ "post.published", "post.failed", "post.target.failed" ]}'{ "endpoint": { "id": "wh_01m4m44q00ea9a11gpjs99ddcy", "url": "https://hooks.cafelumen.pt/rizamo", "description": "Posts to our CRM", "events": [ "post.published", "post.failed", "post.target.failed" ], "profileIds": null, "status": "active", "disabledReason": null, "breaker": "closed", "failingSince": null, "disablesAt": null, "successRate": null, "lastDeliveryAt": null, "createdBy": { "type": "api_key", "keyId": "key_01m4qw9xw0fem94hjmcppyba8c", "name": "CRM sync" }, "onBehalfOf": { "userId": "user_01m4pc7v40fdm89vjt5k51b5h8", "name": "Ana Costa" }, "createdAt": "2026-11-01T15:00:00.000Z", "updatedAt": "2026-11-01T15:00:00.000Z" }, "secret": "whsec_ZXhhbXBsZS1zZWNyZXQtZm9yLWRvY3MtMDAwMQ=="}List webhook endpoints GET
The team's endpoints, oldest first, without their signing secrets. An owner sees every one, also through their agent or their API key; anyone else only those that send for them (`onBehalfOf`). Someone limited to some profiles sees only endpoints limited to those profiles.
Update a webhook endpoint PATCH
Changes apply to events from now on, and to deliveries still waiting for a retry: each is checked against the endpoint as it is when its turn comes. A delivery whose event the endpoint no longer takes (its new types or profiles) ends unsent, with `endpoint_changed` on its attempt; the ones it still takes go to its new `url`. A new `url` starts with a closed breaker, makes the caller (or the person behind the API key or agent) the person it sends for (so does any change to one that sends for nobody, `onBehalfOf` null), and the deliveries it had already tried or held at the old address end with `endpoint_changed` (replay them to send them to the new one). `enabled` false stops it, and its waiting deliveries end at once with `endpoint_disabled`; true starts it again for new events, also after a 410 Gone or days of failures, with its failures forgotten. What ended while it was off is not sent by itself: replay it (`Replay an endpoint's deliveries`).