Zernio
Zernio
API Reference

Webhooks

Create webhookPOSTList webhook delivery logsGETList webhooksGETUpdate webhookPUTDelete webhookDELETERedeliver a webhook eventPOSTSend test webhookPOST
Dashboard
llms.txtOpenAPI
OverviewPlatformsAPI ReferenceResources
Webhooks

Create webhook

Create a new webhook configuration. Maximum 50 webhooks per user.

name, url and events are required. url must be a valid URL and events must contain at least one event. Whitespace is trimmed from url before validation.

Webhooks are auto-disabled only once the endpoint has had no successful delivery for 3 days AND has either reached 20 consecutive terminal failures (each one an event that exhausted the full retry ladder) or been failing continuously for 3 days. The owner is emailed; re-enable it with isActive: true.

A restricted (zrk_) API key can only subscribe to events whose resource group the key holds; an event outside the key's groups is rejected with 403, so a restricted key can never create a subscription broader than itself.

disabledResourceGroups restricts the subscription itself, independently of which key or session later reads it. Events in a disabled group are dropped before delivery to this endpoint, on live delivery and on every replay path (test fire, redelivery, dead-letter requeue), even if they are listed in events. Omit it to receive everything in events, which is how existing subscriptions behave. A restricted key's own disabled groups are always unioned in.

POST
/v1/webhooks/settings

Authorization

bearerAuth
AuthorizationBearer <token>

API key authentication: send your Zernio API key in the Authorization header, prefixed with Bearer.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

{  "success": true,  "webhook": {    "_id": "string",    "name": "string",    "url": "http://example.com",    "secret": "string",    "events": [      "post.scheduled"    ],    "isActive": true,    "lastFiredAt": "2019-08-24T14:15:22Z",    "failureCount": 0,    "customHeaders": {      "property1": "string",      "property2": "string"    },    "disabledResourceGroups": [      "publishing"    ]  }}
Was this page helpful?

Verify credential

Checks whether the bearer credential on this request is valid, without reading any data. Accepts an API key or an OAuth access token. Intended for clients that must validate a credential before use (for example an MCP server verifying an incoming token) so they do not have to call a data endpoint to do it.

List webhook delivery logs

Retrieve recorded webhook delivery attempts for the authenticated user, most recent first. Logs are retained for 30 days. Supports filtering by status, event type, webhook ID, and event ID, plus offset-based pagination. For a restricted (zrk_) API key, rows for events outside the key's resource groups are omitted (`pagination.total` may over-count), and an `event` filter naming such an event is rejected with 403. Events blocked by a subscription's own `disabledResourceGroups` are dropped before delivery, so they produce no log rows for anyone; the exception is the five-minute tail after a denylist change, where an already-queued event can still be delivered and logged.

name*string

Webhook name (1-50 characters)

Length1 <= length <= 50
url*string

Webhook endpoint URL (must be a valid URL, whitespace trimmed)

Formaturi
secret?string

Secret key for HMAC-SHA256 signature verification

events*array<>

Events to subscribe to (at least one required)

Items1 <= items
isActive?boolean

Enable or disable webhook delivery. Defaults to true when omitted.

Defaulttrue
customHeaders?

Custom headers to include in webhook requests

disabledResourceGroups?array<>

Resource groups this subscription does not receive (opt-out denylist). Omit or send an empty array to receive every event in events. Listing a group here drops its events before delivery and on every replay path. Set at creation it applies to everything this subscription ever receives; changed later via PUT it applies to events emitted after the change, with a five-minute tail for events already queued (see that operation). When the caller is a restricted (zrk_) key, that key's own disabled groups are unioned into whatever you send here, so a restricted key can never create a subscription wider than itself.