Endpoints

get/projects/{projectId}/endpoints

List a project’s endpoints

curl -X GET https://api.catchook.com/projects/{projectId}/endpoints \
  -H "Authorization: Bearer $CATCHOOK_API_KEY"

post/projects/{projectId}/endpoints

Create an endpoint

curl -X POST https://api.catchook.com/projects/{projectId}/endpoints \
  -H "Authorization: Bearer $CATCHOOK_API_KEY" \
  -H "Content-Type: application/json" \ \
  -d '{ … }'

get/endpoints/{id}

Get an endpoint

curl -X GET https://api.catchook.com/endpoints/{id} \
  -H "Authorization: Bearer $CATCHOOK_API_KEY"

patch/endpoints/{id}

Update an endpoint

Takes up to 60 seconds to affect incoming webhooks: the ingest service caches endpoint configuration, and that cache expires rather than being purged.

curl -X PATCH https://api.catchook.com/endpoints/{id} \
  -H "Authorization: Bearer $CATCHOOK_API_KEY" \
  -H "Content-Type: application/json" \ \
  -d '{ … }'

delete/endpoints/{id}

Delete an endpoint (soft delete)

curl -X DELETE https://api.catchook.com/endpoints/{id} \
  -H "Authorization: Bearer $CATCHOOK_API_KEY"

post/endpoints/{id}/test

Send a test webhook to this endpoint

Signs a sample payload with this endpoint's own verification config and posts it to its public ingest URL, so it goes through the same path a real provider event does: rate limiting, signature verification, fan-out to every active destination, and a recorded event you can then open, replay, or watch arrive in `catchook listen`. Not every scheme can be tested this way, and the ones that cannot get a 400 saying why: `ip_allowlist` (the request comes from Catchook, never from an allowlisted address), `jwt` (a valid token has to be minted by whoever holds the key) and `twilio_signature` (Twilio signs the URL together with its sorted form parameters). For those, send a real event from the provider.

curl -X POST https://api.catchook.com/endpoints/{id}/test \
  -H "Authorization: Bearer $CATCHOOK_API_KEY"

post/endpoints/{id}/pause

Pause an endpoint

Incoming webhooks are answered 409 while paused, and still recorded so the arrivals stay visible. Takes up to 60 seconds to affect incoming webhooks: the ingest service caches endpoint configuration, and that cache expires rather than being purged.

curl -X POST https://api.catchook.com/endpoints/{id}/pause \
  -H "Authorization: Bearer $CATCHOOK_API_KEY"

post/endpoints/{id}/resume

Resume a paused endpoint

Takes up to 60 seconds to affect incoming webhooks: the ingest service caches endpoint configuration, and that cache expires rather than being purged.

curl -X POST https://api.catchook.com/endpoints/{id}/resume \
  -H "Authorization: Bearer $CATCHOOK_API_KEY"

post/endpoints/{id}/rotate-secret

Regenerate the verification secret (shown once)

The old secret stops being accepted once this takes effect. Takes up to 60 seconds to affect incoming webhooks: the ingest service caches endpoint configuration, and that cache expires rather than being purged.

curl -X POST https://api.catchook.com/endpoints/{id}/rotate-secret \
  -H "Authorization: Bearer $CATCHOOK_API_KEY"