Webhooks API

Guide with signature verification code: Webhooks.

Endpoint	Purpose
GET /api/v1/webhooks	List subscriptions
POST /api/v1/webhooks	Create — returns whsec_ secret once
GET /api/v1/webhooks/{id}	Get one (incl. last_status, last_delivery_at)
DELETE /api/v1/webhooks/{id}	Delete
POST /api/v1/webhooks/{id}/secret	Re-reveal the signing secret
POST /api/v1/webhooks/{id}/ping	Fire a webhook.ping test event

POST /api/v1/webhooks

Body: url (HTTPS only; private and internal addresses rejected), events (array of event types or ["*"]), description.

Delivery contract

Headers X-Klaw-Signature (sha256= HMAC of the raw body), X-Klaw-Event, X-Klaw-Delivery. 4-second timeout per attempt; delivery status is recorded on the subscription. Verify with a timing-safe HMAC comparison.