Documentation
The API is small on purpose. These are the pages that cover it, in the order most people need them.
In short
- Start with the walkthrough: account, endpoint, first delivery.
- Every dashboard action is an API call with the same permissions.
- Signature verification is fifteen lines — the guide has it in full.
Start here
Your first delivery
Account, destination, publish, and the timeline that shows it arriving.
Consumers
Verifying signatures
The three headers, the verification function, and the mistake everyone makes once.
Reliability
Retries and idempotency
The schedule, what a retry preserves, and how a consumer avoids double-processing.
Operations
Dead letters and recovery
What happens when the schedule is spent, and the two buttons that fix it.
Inbound
Platform guides
Receiving verified webhooks from fifteen providers.
Everything
All guides
Testing, debugging, egress safety, and the rest.
API surface
Authentication is a bearer token: an API key for machines, a session for the dashboard.
| Endpoint | What it does |
|---|---|
POST /v1/events | Publish an event. Answers 202 once it is stored |
POST /v1/events/batch | Publish several; each item is judged on its own |
GET /v1/events | The event log, filterable by type |
GET /v1/events/{id}/attempts | The delivery timeline for one event |
POST /v1/events/{id}/replay | Send an event again |
POST /v1/events/replay-missing | Repair a gap: re-queue events with no attempt |
POST /v1/endpoints | Create a destination. The signing secret is returned once |
POST /v1/endpoints/{id}/rotate-secret | Rotate with an overlap window |
POST /v1/endpoints/{id}/recover | Resume a disabled destination and replay its dead letters |
GET /v1/endpoints/{id}/health | Success rate, latency percentiles, consecutive failures |
POST /v1/sources | Create a verified inbound source |
POST /ingest/{id} | Where the third-party provider posts |
GET /v1/dlq · POST /v1/dlq/replay | Inspect and drain dead letters |
GET /v1/stats · GET /v1/usage | Volumes and billable units |
POST /v1/keys | Mint a scoped key. Never more powerful than the key that created it |
/v1/members | Team management |
Errors are RFC 9457 problem documents: a type, a title, a status and a readable detail. A resource that belongs to another tenant is reported as not found.
For agents
HookGet ships an MCP server — the same API behind eighteen tools, so an assistant can publish an event, read a delivery timeline, diagnose an endpoint or repair a gap. Operations that re-send real traffic require an explicit confirmation argument rather than a polite label.