REST API

Language-agnostic REST API reference for webhooks.cc. Use any HTTP client to manage endpoints, inspect requests and captured emails, configure forwarding, and stream webhooks.

Updated Oct 2026

Overview

The TypeScript SDK wraps this API, but you can call it directly from any language using standard HTTP requests. All request and response bodies use JSON.

Base URL: https://webhooks.cc

Webhook receiver URL: https://go.webhooks.cc

Email address: {slug}@mailhooks.cc (see Email capture)

Authentication

Authenticate by passing your API key in the Authorization header:

Authorization: Bearer whcc_...

API keys are generated from the API keys page. Keys use the whcc_ prefix and are stored as SHA-256 hashes; the raw key is shown only once at creation time.

Some sensitive operations (account deletion, API key management) require a Supabase session token instead of an API key. These operations return 403 when called with an API key.

Endpoints

Create endpoint

curl -X POST https://webhooks.cc/api/endpoints \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "my-endpoint"}'

Response:

{
  "id": "...",
  "slug": "abc123",
  "name": "my-endpoint",
  "url": "https://go.webhooks.cc/w/abc123",
  "createdAt": 1234567890000,
  "emailAddress": "[email protected]",
  "showEmailExtracts": true,
  "forwardEnabled": false,
  "forwardUrl": null,
  "hasForwardSecret": false,
  "forwardHttp": false,
  "forwardEmail": true,
  "forwardFormat": "auto",
  "forwardHeaders": [],
  "forwardAppendPath": true,
  "forwardRetrySeconds": 86400,
  "forwardKeepOrder": false,
  "forwardSentField": null
}

Email and forwarding fields on every endpoint:

Field	Description
`emailAddress`	The endpoint's email address. `null` for guest endpoints, which receive no email.
`showEmailExtracts`	Whether codes and links found in emails are shown in the dashboard and included in forwarded JSON. Default `true`.
`forwardEnabled`	Whether captured requests are forwarded to `forwardUrl`.
`forwardUrl`	Where requests are forwarded. Only returned to the endpoint's owner.
`hasForwardSecret`	Whether a forwarding secret exists. The secret itself is never included.
`forwardHttp`, `forwardEmail`	Which kinds are forwarded: HTTP requests, emails.
`forwardFormat`	`auto` (picked from the URL), `as_received`, `json` or `chat`. See Formats.
`forwardHeaders`	Your own headers, `[{ "name", "value" }]` with masked values. Only returned to the endpoint's owner.
`forwardAppendPath`	Whether the path after the slug is added to the URL for relayed requests.
`forwardRetrySeconds`	How long failed deliveries are retried: `0`, `3600` or `86400`.
`forwardKeepOrder`	One delivery at a time, in capture order.
`forwardSentField`	The JSON body field holding the sender's own timestamp, or `null`. See Timing.

List endpoints

curl https://webhooks.cc/api/endpoints \
  -H "Authorization: Bearer whcc_..."

Returns { "owned": [...], "shared": [...] }: the endpoints you own, and the endpoints shared with you through a team. Shared endpoints leave out notificationUrl, forwardUrl and forwardHeaders.

Get endpoint

curl https://webhooks.cc/api/endpoints/abc123 \
  -H "Authorization: Bearer whcc_..."

Update endpoint

Update an endpoint's name, mock response, notification webhook, or email settings. Only the fields you send change.

curl -X PATCH https://webhooks.cc/api/endpoints/abc123 \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "new-name", "mockResponse": {"status": 200, "body": "{\"ok\":true}", "headers": {"Content-Type": "application/json"}}, "notificationUrl": "https://hooks.slack.com/services/..."}'

Set "mockResponse": null to clear the mock response and return to the default 200 OK. Set "notificationUrl": null to stop sending notifications. The notificationUrl must be a valid http or https URL, max 2048 characters.

Set "showEmailExtracts": false to stop picking out codes and links in emails. The forward* fields are covered under Forwarding.

Team members can change name, mockResponse, and responseRules on shared endpoints. showEmailExtracts and the notification, signing, and forwarding settings are owner only and return 403 for anyone else, because showEmailExtracts also decides what forwarding sends.

Delete endpoint

Deletes the endpoint and all its captured requests.

curl -X DELETE https://webhooks.cc/api/endpoints/abc123 \
  -H "Authorization: Bearer whcc_..."

Requests

List requests

curl "https://webhooks.cc/api/endpoints/abc123/requests?limit=50" \
  -H "Authorization: Bearer whcc_..."

Returns an array of request objects, newest first. Add kind=email for captured emails only, or kind=http for HTTP requests only; the paginated listing below takes the same parameter (send it on every page).

List requests (paginated)

curl "https://webhooks.cc/api/endpoints/abc123/requests/paginated?limit=20&cursor=..." \
  -H "Authorization: Bearer whcc_..."

Response:

{
  "items": [{ "id": "...", "method": "POST", "...": "..." }],
  "cursor": "eyJ...",
  "hasMore": true
}

Pass the returned cursor to the next request to fetch the next page.

Get single request

curl https://webhooks.cc/api/requests/REQUEST_ID \
  -H "Authorization: Bearer whcc_..."

Response:

{
  "id": "REQUEST_ID",
  "endpointId": "...",
  "method": "POST",
  "path": "/",
  "headers": { "content-type": "application/json", "...": "..." },
  "body": "{\"event\": \"test\"}",
  "queryParams": {},
  "contentType": "application/json",
  "ip": "203.0.113.1",
  "size": 18,
  "receivedAt": 1234567890000,
  "detectedProvider": "stripe",
  "detectedEvent": "checkout.session.completed",
  "signatureVerified": true,
  "signatureError": null,
  "signingProvider": "stripe",
  "kind": "http",
  "email": null
}

detectedProvider and detectedEvent are best-effort metadata derived from headers and body shape. They power the provider icon and event badge in the dashboard. Signature fields are present when endpoint-level verification is configured.

kind is email for captured emails. Those have method set to EMAIL, the recipient address as path, the original message as body, and the parsed message (subject, addresses, text and HTML parts, attachment list, sender checks) as email.

Clear requests

Delete all captured requests for an endpoint without deleting the endpoint itself.

curl -X DELETE "https://webhooks.cc/api/endpoints/abc123/requests" \
  -H "Authorization: Bearer whcc_..."

Send test webhook

Send a test webhook to one of your endpoints through the API.

curl -X POST https://webhooks.cc/api/send-test \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"slug": "abc123", "method": "POST", "headers": {"content-type": "application/json"}, "body": "{\"event\": \"test\"}"}'

Send test email

Deliver a sample email (with a one-time code and a link) to one of your endpoints. It is captured and counted like any other email, but it does not travel over SMTP, so no sender checks run on it.

curl -X POST https://webhooks.cc/api/send-test-email \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"slug": "abc123", "tag": "run-42"}'

tag is optional: with it, the sample goes to [email protected], so a test can wait for its own email. Returns { "status": "captured", "requestId": "..." }. A slug you cannot access returns 404, and so does a guest endpoint, since only endpoints on an account receive email. An endpoint whose quota is used up returns 409. Rate limited to 10 requests per minute.

Forwarding

Forwarding sends every HTTP request and email an endpoint captures to your URL: relayed as received, as signed JSON, or as a chat message for Slack and Discord, and retried until it is accepted. The formats and how to verify them are described in Forwarding. Only the endpoint's owner can configure forwarding: the owner-only routes below return 404 to anyone else, and the endpoint update returns 403.

Turn forwarding on

curl -X PATCH https://webhooks.cc/api/endpoints/abc123 \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"forwardUrl": "https://example.com/hooks", "forwardHttp": true, "forwardEmail": true, "forwardEnabled": true}'

"forwardEnabled": true needs a forwardUrl, sent in the same request or saved before. The URL must be https on a public host name (no IP addresses or localhost), max 2048 characters. Saving the first URL creates the endpoint's signing secret, so you can set up your handler and send a test delivery before turning forwarding on. Send "forwardEnabled": false to stop; deliveries still waiting are marked failed, and so are those of a kind you switch off. Send "forwardUrl": null to remove the URL once forwarding is off.

The other settings, all optional:

Field	Values
`forwardHttp`	`true` to forward HTTP requests. Default `false`.
`forwardEmail`	`true` to forward emails. Default `true`.
`forwardFormat`	`auto` (default), `as_received`, `json` or `chat`.
`forwardHeaders`	The whole list of your headers, at most 10: `[{ "name": "Authorization", "value": "Bearer ..." }]`. A `null` value keeps the stored value of that name; `[]` removes them all.
`forwardAppendPath`	`false` to send relayed requests to the URL exactly as written. Default `true`.
`forwardRetrySeconds`	`86400` (default), `3600`, or `0` for a single try.
`forwardKeepOrder`	`true` for one delivery at a time, in capture order. Default `false`.
`forwardSentField`	A JSON body field with the sender's timestamp, such as `publishedAt` or `data.publishedAt`; `null` clears it.

Get the signing secret

curl https://webhooks.cc/api/endpoints/abc123/forwarding \
  -H "Authorization: Bearer whcc_..."

Returns { "secret": "whsec_..." }, or 404 before a URL has been saved.

Rotate the signing secret

curl -X POST https://webhooks.cc/api/endpoints/abc123/forwarding \
  -H "Authorization: Bearer whcc_..."

Returns { "secret": "whsec_..." } with the new secret. Every delivery from now on, retries included, is signed with it.

Send a test delivery

Sends the endpoint's newest captured request (or a sample marked as a test, if none has arrived yet) to the saved URL once, exactly as a delivery would go out, and reports what came back. It works with forwarding on or off, and nothing is retried or added to the delivery log. Send {"kind": "email"} or {"kind": "http"} to pick the kind; by default it is HTTP when HTTP requests are forwarded, otherwise email.

curl -X POST https://webhooks.cc/api/endpoints/abc123/forwarding/test \
  -H "Authorization: Bearer whcc_..."

Response:

{
  "status": 200,
  "durationMs": 182,
  "excerpt": "ok",
  "error": null,
  "delivered": true,
  "sample": false,
  "kind": "http",
  "format": "as_received",
  "url": "https://example.com/hooks/stripe/events",
  "target": "example.com/hooks/stripe/events",
  "request": { "method": "POST", "path": "/stripe/events", "subject": null, "receivedAt": 1791538201882 },
  "sender": { "at": 1791538201685, "source": "publishedAt", "wholeSeconds": false }
}

delivered is true when the URL answered 2xx. error says why no answer arrived (a timeout, a refused connection, a TLS problem), and excerpt is the start of the response body. sender is the sender's own timestamp when the request has one (Timing). Returns 400 when no URL is saved. Rate limited to 10 requests per minute.

List deliveries

curl "https://webhooks.cc/api/endpoints/abc123/deliveries?limit=50&status=failed" \
  -H "Authorization: Bearer whcc_..."

Returns the endpoint's deliveries, newest first. limit is 1 to 100 (default 5); status is all (default), pending (queued or retrying) or failed; before takes the cursor of the last row you have, for older rows (URL-encode it; it is opaque). Each has id, requestId, kind, status (pending, succeeded or failed), attempts, createdAt, finishedAt, nextAttemptAt, lastStatus, lastError, lastDurationMs (your server's time on the latest try), format, senderAt and senderSource (the sender's timestamp and where it was read), cursor, and the request's method, path, receivedAt and, for an email, subject.

Delivery counts

curl https://webhooks.cc/api/endpoints/abc123/deliveries/summary \
  -H "Authorization: Bearer whcc_..."

Returns { "last24h": { "delivered": 1284, "failed": 0 }, "pending": 3, "failed": 1, "total": 1312 }: what was delivered and failed among deliveries of the last 24 hours, what is waiting now, and the failed and total counts among the deliveries kept. Each count stops at 100,000.

Redeliver all failed

curl -X POST https://webhooks.cc/api/endpoints/abc123/deliveries/redeliver-failed \
  -H "Authorization: Bearer whcc_..."

Queues every request whose latest delivery failed again, oldest first, with the current settings, and returns { "queued": 12 }. At most 1,000 deliveries wait at a time, so queued can be lower than the failed count; call it again once those are through. Returns 409 when forwarding is off. Rate limited to 10 requests per minute.

List deliveries of a request

curl https://webhooks.cc/api/requests/REQUEST_ID/deliveries \
  -H "Authorization: Bearer whcc_..."

Response:

[
  {
    "id": "...",
    "requestId": "REQUEST_ID",
    "kind": "http",
    "status": "pending",
    "attempts": 2,
    "createdAt": 1791450602000,
    "finishedAt": null,
    "nextAttemptAt": 1791450752000,
    "lastStatus": 500,
    "lastError": "The URL answered 500.",
    "format": "as_received",
    "target": "example.com/hooks/stripe/events",
    "senderAt": null,
    "senderSource": null,
    "attemptLog": [
      {
        "attemptedAt": 1791450632000,
        "status": 500,
        "durationMs": 95,
        "error": "The URL answered 500.",
        "responseExcerpt": "Internal Server Error"
      },
      {
        "attemptedAt": 1791450602000,
        "status": 500,
        "durationMs": 104,
        "error": "The URL answered 500.",
        "responseExcerpt": "Internal Server Error"
      }
    ]
  }
]

Lists up to 20 deliveries of the request, newest first, each with every try (newest first). nextAttemptAt is set while a delivery is pending; attemptedAt is when a try ended. target is where it went (host and path; the host only for Slack and Discord, whose path is a secret, and for team members). Anyone who can read the request can list its deliveries, team members included. A request that was never forwarded returns [].

Redeliver a request

curl -X POST https://webhooks.cc/api/requests/REQUEST_ID/deliveries \
  -H "Authorization: Bearer whcc_..."

Queues another delivery of an HTTP request or an email, sent with the endpoint's current settings, and returns { "id": "..." }. It also sends a request that was never forwarded. Owner only. Returns 409 when forwarding, or forwarding of that kind, is off. Rate limited to 30 requests per minute.

Search

Search captured requests across endpoints with optional filters.

curl "https://webhooks.cc/api/search/requests?slug=abc123&method=POST&q=stripe&limit=20" \
  -H "Authorization: Bearer whcc_..."

Query parameters:

Param	Type	Description
`slug`	`string`	Filter by endpoint slug
`method`	`string`	Filter by HTTP method (`EMAIL` for emails)
`kind`	`string`	`http` or `email`
`q`	`string`	Free-text search
`from`	`number`	Start time (Unix timestamp in ms)
`to`	`number`	End time (Unix timestamp in ms)
`limit`	`number`	Max results (default: 50)
`offset`	`number`	Pagination offset
`order`	`string`	`"asc"` or `"desc"` (default)

Search count

Count matching requests without returning them.

curl "https://webhooks.cc/api/search/requests/count?slug=abc123&method=POST" \
  -H "Authorization: Bearer whcc_..."

Returns { "count": 42 }. Accepts the same query parameters as search (except limit, offset, order).

Real-time streaming (SSE)

Stream incoming requests as Server-Sent Events. Useful for building integrations that react to webhooks in real time.

curl -N "https://webhooks.cc/api/stream/abc123" \
  -H "Authorization: Bearer whcc_..." \
  -H "Accept: text/event-stream"

Each captured request arrives as an SSE message:

event: request
data: {"_id":"...","_creationTime":1234567890000,"endpointId":"...","method":"POST","path":"/","headers":{...},"body":"...","receivedAt":1234567890000,"kind":"http"}

The server sends keepalive pings (:ping) every 30 seconds to keep the connection alive. Maximum connection duration is 30 minutes; reconnect when the stream closes.

A stream message names the request id _id (not id) and has no email field. Emails arrive as request events too, with "kind": "email", "method": "EMAIL" and the recipient address as path; fetch the request by its _id for the parsed message.

Usage

Check your current request quota and usage.

curl https://webhooks.cc/api/usage \
  -H "Authorization: Bearer whcc_..."

Response:

{
  "used": 12,
  "limit": 50,
  "remaining": 38,
  "plan": "free",
  "periodEnd": 1234567890000
}

Teams

Manage teams, share endpoints, and invite members. Any account can create a team; inviting members and sharing endpoints require the team to have an active Teams subscription ($12/seat/month).

List teams

curl https://webhooks.cc/api/teams \
  -H "Authorization: Bearer whcc_..."

Returns an array of team objects that you own or belong to.

Create team

curl -X POST https://webhooks.cc/api/teams \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "My Team"}'

Response:

{
  "id": "TEAM_ID",
  "name": "My Team",
  "ownerId": "...",
  "createdAt": "2026-03-28T00:00:00.000Z"
}

Update team

Rename a team. Only the team owner can update.

curl -X PATCH https://webhooks.cc/api/teams/TEAM_ID \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"name": "Renamed Team"}'

Delete team

Delete a team and remove all memberships. Only the team owner can delete.

curl -X DELETE https://webhooks.cc/api/teams/TEAM_ID \
  -H "Authorization: Bearer whcc_..."

Returns 204 No Content on success.

Share one of your endpoints so all team members can view its captured requests.

curl -X POST https://webhooks.cc/api/teams/TEAM_ID/endpoints \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"endpointId": "ENDPOINT_ID"}'

Unshare endpoint

Remove an endpoint from a team.

curl -X DELETE https://webhooks.cc/api/teams/TEAM_ID/endpoints/ENDPOINT_ID \
  -H "Authorization: Bearer whcc_..."

Returns 204 No Content on success.

Invite member

Invite a user to your team by email. Only the team owner can invite.

curl -X POST https://webhooks.cc/api/teams/TEAM_ID/invite \
  -H "Authorization: Bearer whcc_..." \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]"}'

List members

List all members and pending invites for a team.

curl https://webhooks.cc/api/teams/TEAM_ID/members \
  -H "Authorization: Bearer whcc_..."

Response:

{
  "members": [
    { "userId": "...", "email": "[email protected]", "role": "owner" },
    { "userId": "...", "email": "[email protected]", "role": "member" }
  ],
  "pendingInvites": [{ "id": "...", "email": "[email protected]", "createdAt": "..." }]
}

Remove member

Remove a member from a team. Only the team owner can remove members.

curl -X DELETE https://webhooks.cc/api/teams/TEAM_ID/members/USER_ID \
  -H "Authorization: Bearer whcc_..."

Returns 204 No Content on success.

Leave team

Leave a team you are a member of. Owners cannot leave their own team; delete it instead.

curl -X POST https://webhooks.cc/api/teams/TEAM_ID/leave \
  -H "Authorization: Bearer whcc_..."

Invites

Manage team invitations sent to you.

List pending invites

curl https://webhooks.cc/api/invites \
  -H "Authorization: Bearer whcc_..."

Returns an array of pending invite objects addressed to your account.

Accept invite

curl -X POST https://webhooks.cc/api/invites/INVITE_ID/accept \
  -H "Authorization: Bearer whcc_..."

Decline invite

curl -X POST https://webhooks.cc/api/invites/INVITE_ID/decline \
  -H "Authorization: Bearer whcc_..."

Session-token-only routes

Some routes require a Supabase session token (from browser login) instead of an API key. These return 403 when called with an API key.

GET /api/api-keys: list your API keys
POST /api/api-keys: create a new API key
DELETE /api/api-keys?id=...: delete an API key
DELETE /api/account: delete your account and all data

These routes are designed for the web dashboard, not programmatic access.

Error handling

All errors return a JSON body with an error field:

{ "error": "Invalid or missing API key" }

Status	Meaning
`400`	Validation error: check request body and parameters
`401`	Invalid or missing API key
`403`	Not allowed, for example an owner-only setting
`404`	Resource not found
`409`	Conflict, for example redelivering with forwarding off
`429`	Rate limited: check `Retry-After` header for wait time
`500`	Server error

Rate limit headers

Rate-limited endpoints return these headers on every response (not just 429s):

Header	Description
`X-RateLimit-Limit`	Maximum requests allowed in the current window
`X-RateLimit-Remaining`	Remaining requests in the current window
`X-RateLimit-Reset`	Unix timestamp (seconds) when the window resets
`Retry-After`	Seconds to wait (only on 429 responses)

Language examples

Python

import requests
 
API_KEY = "whcc_..."
BASE = "https://webhooks.cc"
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}
 
# Create endpoint
endpoint = requests.post(f"{BASE}/api/endpoints", headers=HEADERS, json={"name": "my-endpoint"}).json()
slug = endpoint["slug"]
print(f"Webhook URL: {endpoint['url']}")
 
# Send a test webhook
requests.post(f"{BASE}/api/send-test", headers=HEADERS, json={
    "slug": slug,
    "method": "POST",
    "headers": {"content-type": "application/json"},
    "body": '{"event": "test"}'
})
 
# List captured requests
captured = requests.get(f"{BASE}/api/endpoints/{slug}/requests", headers=HEADERS).json()
for req in captured:
    print(f"{req['method']} {req['path']} {req['receivedAt']}")

Go

package main
 
import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
)
 
const (
	base   = "https://webhooks.cc"
	apiKey = "whcc_..."
)
 
func main() {
	// Create endpoint
	body, _ := json.Marshal(map[string]string{"name": "my-endpoint"})
	req, _ := http.NewRequest("POST", base+"/api/endpoints", bytes.NewReader(body))
	req.Header.Set("Authorization", "Bearer "+apiKey)
	req.Header.Set("Content-Type", "application/json")
 
	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
 
	var endpoint map[string]interface{}
	json.Unmarshal(data, &endpoint)
	fmt.Printf("Webhook URL: %s\n", endpoint["url"])
 
	// List requests
	slug := endpoint["slug"].(string)
	req, _ = http.NewRequest("GET", base+"/api/endpoints/"+slug+"/requests", nil)
	req.Header.Set("Authorization", "Bearer "+apiKey)
	resp, _ = http.DefaultClient.Do(req)
	defer resp.Body.Close()
	data, _ = io.ReadAll(resp.Body)
 
	var requests []map[string]interface{}
	json.Unmarshal(data, &requests)
	for _, r := range requests {
		fmt.Printf("%s %s\n", r["method"], r["path"])
	}
}

Ruby

require "net/http"
require "json"
require "uri"
 
API_KEY = "whcc_..."
BASE = "https://webhooks.cc"
 
def api_request(method, path, body = nil)
  uri = URI("#{BASE}#{path}")
  req = case method
        when :get    then Net::HTTP::Get.new(uri)
        when :post   then Net::HTTP::Post.new(uri)
        when :delete then Net::HTTP::Delete.new(uri)
        end
  req["Authorization"] = "Bearer #{API_KEY}"
  req["Content-Type"] = "application/json"
  req.body = body.to_json if body
 
  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
  JSON.parse(res.body)
end
 
# Create endpoint
endpoint = api_request(:post, "/api/endpoints", { name: "my-endpoint" })
slug = endpoint["slug"]
puts "Webhook URL: #{endpoint['url']}"
 
# Send a test webhook
api_request(:post, "/api/send-test", {
  slug: slug,
  method: "POST",
  headers: { "content-type" => "application/json" },
  body: '{"event": "test"}'
})
 
# List captured requests
requests = api_request(:get, "/api/endpoints/#{slug}/requests")
requests.each do |req|
  puts "#{req['method']} #{req['path']} #{req['receivedAt']}"
end

Rust

use reqwest::header::{AUTHORIZATION, CONTENT_TYPE, HeaderMap, HeaderValue};
use serde_json::{json, Value};
 
const BASE: &str = "https://webhooks.cc";
const API_KEY: &str = "whcc_...";
 
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = reqwest::Client::new();
    let mut headers = HeaderMap::new();
    headers.insert(AUTHORIZATION, HeaderValue::from_str(&format!("Bearer {API_KEY}"))?);
    headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
 
    // Create endpoint
    let endpoint: Value = client
        .post(format!("{BASE}/api/endpoints"))
        .headers(headers.clone())
        .json(&json!({"name": "my-endpoint"}))
        .send()
        .await?
        .json()
        .await?;
 
    let slug = endpoint["slug"].as_str().unwrap();
    println!("Webhook URL: {}", endpoint["url"]);
 
    // Send a test webhook
    client
        .post(format!("{BASE}/api/send-test"))
        .headers(headers.clone())
        .json(&json!({
            "slug": slug,
            "method": "POST",
            "headers": {"content-type": "application/json"},
            "body": r#"{"event": "test"}"#
        }))
        .send()
        .await?;
 
    // List captured requests
    let requests: Vec<Value> = client
        .get(format!("{BASE}/api/endpoints/{slug}/requests"))
        .headers(headers)
        .send()
        .await?
        .json()
        .await?;
 
    for req in &requests {
        println!("{} {}", req["method"], req["path"]);
    }
 
    Ok(())
}

Next steps

TypeScript SDK reference

Full method reference for the @webhooks-cc/sdk package.

Email forwarding

The forwarded JSON payload, signature verification, and the retry schedule.

Plans & Limits

Request quotas, billing periods, and plan details.

Interactive API Explorer

Try the API directly from your browser with the interactive reference.

REST API

Overview

Authentication

Endpoints

Create endpoint

List endpoints

Get endpoint

Update endpoint

Delete endpoint

Requests

List requests

List requests (paginated)

Get single request

Clear requests

Send test webhook

Send test email

Forwarding

Turn forwarding on

Get the signing secret

Rotate the signing secret

Send a test delivery

List deliveries

Delivery counts

Redeliver all failed

List deliveries of a request

Redeliver a request

Search

Search count

Real-time streaming (SSE)

Usage

Teams

List teams

Create team

Update team

Delete team

Share endpoint with team

Unshare endpoint

Invite member

List members

Remove member

Leave team

Invites

List pending invites

Accept invite

Decline invite

Session-token-only routes

Error handling

Rate limit headers

Language examples

Python

Go

Ruby

Rust

Next steps