Update a webhook endpoint
Changes apply to events from now on, and to deliveries still waiting for a retry: each is checked against the endpoint as it is when its turn comes. A delivery whose event the endpoint no longer takes (its new types or profiles) ends unsent, with endpoint_changed on its attempt; the ones it still takes go to its new url. A new url starts with a closed breaker, makes the caller (or the person behind the API key or agent) the person it sends for (so does any change to one that sends for nobody, onBehalfOf null), and the deliveries it had already tried or held at the old address end with endpoint_changed (replay them to send them to the new one). enabled false stops it, and its waiting deliveries end at once with endpoint_disabled; true starts it again for new events, also after a 410 Gone or days of failures, with its failures forgotten. What ended while it was off is not sent by itself: replay it (Replay an endpoint's deliveries).
apiKeyAuthorizationBearer <token>An API key from the web app, under Developers. It starts with rz_live_.
id*stringThe webhook endpoint's id (wh_).
length <= 100application/json- body
url?stringWhere Rizamo sends events: an https address on the public internet.
1 <= length <= 2048description?stringWhat it is for, for the people of the team.
length <= 200events?array<>|The event types it receives. Null: every type, those Rizamo adds later included. A key or agent lists the inbox's types (comment.received, message.received, message.sent) only with inbox:read, and comment_automation.* only with automations:read; with null, the endpoint gets none of those it cannot read.
profileIds?array<>|Only events of these profiles. Null: every profile's, and the events of no profile. Someone limited to some profiles gives some of theirs.
enabled?booleanfalse stops it; true starts it again, also after a 410 Gone or days of failures.
OK
application/json- response
id*stringurl*stringuridescription*stringevents*array<>|The event types it receives. Null: every type, those Rizamo adds later included. The inbox's (comment.received, message.received, message.sent) and comment automations' (comment_automation.*) carry what people wrote: an endpoint a key or agent made, or last pointed at its url, gets them only if it had inbox:read (automations:read for automations), whatever this lists.
profileIds*array<string>|Only events of these profiles, and of those only the ones its person reaches now (onBehalfOf). Null: every profile's, and the events of no profile. Empty once every profile it was limited to is deleted: it is then disabled. Someone limited to some profiles only sees and makes endpoints within them.
status*stringactive: sends, and its last attempt was delivered (or none was made yet). failing: sends, but its last attempt failed; after 10 failures in a row its deliveries wait while one at a time tries it (breaker). disabled: sends nothing, see disabledReason.
"active""failing""disabled"disabledReason*|by_request: someone set enabled to false. gone: the endpoint answered 410 Gone. failing: its breaker was open and nothing got through for 5 days; for these two Rizamo emails the team's owners and editors. profile_deleted: every profile it was limited to was deleted, which leaves profileIds empty; give it profiles to enable it again. Null while it sends.
breaker*stringopen: it failed 10 times in a row, so its deliveries wait and one at a time tries it every 15 minutes; the first one delivered, or a test that gets through, sends the rest. closed: deliveries go as they come. A new url starts closed.
"closed""open"failingSince*|Its first failed attempt of the failures in a row (failures hours apart, further than the retries' spacing, start anew). Null once an attempt is delivered.
disablesAt*|When Rizamo disables it unless an attempt is delivered first: failingSince and 5 days, while its breaker is open. Null otherwise.
successRate*|Of the attempts in the last 7 days, the percent delivered (a 2xx answer). Null with none.
lastDeliveryAt*|When Rizamo last tried to deliver to it, whatever the answer.
createdBy*||||nullonBehalfOf*|The person it sends for: whoever made it or last pointed it at its url, or the person behind the API key or agent that did. It sends only events of the profiles they reach now (events of no profile only while they reach every profile), owners and they alone see and manage it, and it is deleted when they leave the team. Null once they are no longer on the team: it sends nothing until an owner changes it, which makes them its person.
createdAt*stringdate-timeupdatedAt*stringdate-timecurl -X PATCH 'https://api.rizamo.com/v1/webhooks/wh_01m4m44q00ea9a11gpjs99ddcy' \ -H 'Content-Type: application/json' \ -d '{ "events": null}'{ "id": "wh_01m4m44q00ea9a11gpjs99ddcy", "url": "https://hooks.cafelumen.pt/rizamo", "description": "Posts to our CRM", "events": null, "profileIds": null, "status": "active", "disabledReason": null, "breaker": "closed", "failingSince": null, "disablesAt": null, "successRate": 100, "lastDeliveryAt": "2026-11-06T09:00:04.000Z", "createdBy": { "type": "api_key", "keyId": "key_01m4qw9xw0fem94hjmcppyba8c", "name": "CRM sync" }, "onBehalfOf": { "userId": "user_01m4pc7v40fdm89vjt5k51b5h8", "name": "Ana Costa" }, "createdAt": "2026-11-01T15:00:00.000Z", "updatedAt": "2026-11-08T12:00:00.000Z"}Create a webhook endpoint POST
Events from now on go to it, of the profiles the person it sends for reaches (`onBehalfOf`: the caller, or the person behind the API key or agent), and it is deleted when they leave the team. Each event goes as one POST of JSON (the event as `List events` gives it), signed with Standard Webhooks' headers (`webhook-id`, the event's id; `webhook-timestamp`; `webhook-signature`). A 2xx answer within 15 seconds is delivered; anything else is tried again 6 times over about 18 hours, and a 410 Gone disables the endpoint. After 10 failures in a row an endpoint's deliveries wait while one at a time tries it, and one that keeps failing like that with nothing delivered for 5 days is disabled; Rizamo emails the team's owners and the person it sends for. Never sent to rizamo.com or workers.dev addresses, nor to private ones. Deliveries are not in order: order one resource's events by `at`. Its signing secret is in the answer, and only there. A team has up to 20 endpoints.
Delete a webhook endpoint DELETE
Nothing more is sent to it, and its deliveries are deleted with it.