API reference
6 endpoints, served at https://orbitwrite.com/api/v1. Each one lists the credentials it accepts, its parameters and every response it can give.
Returns endpoints (never the signing secret — only its masked hint) plus the workspace's tags for the optional tag filter. Requires webhook:read, which every role holds.
An API key or OAuth access token as a bearer token, or a signed-in session.
organizationIdstringSession callers only — an API key already determines the workspace.
At least 1 character.
200WebhookEndpointListThe workspace's webhook endpoints
curl -X GET "https://orbitwrite.com/api/v1/webhook-endpoints" \
-H "Authorization: Bearer $ORBITWRITE_API_KEY"{
"endpoints": [
{
"id": "string",
"label": "string",
"url": "string",
"secretHint": "string",
"events": [
"string"
],
"tagId": "string",
"enabled": true
}
],
"tags": [
{
"id": "string",
"name": "string",
"color": "string"
}
]
}Registers a receiver and returns its signing secret exactly once — there is no route that returns it again, so store it now. Requires webhook:create (owner/admin, or a key scoped to it).
An API key or OAuth access token as a bearer token, or a signed-in session.
urlstringRequiredAt least 1 character.
eventsstring[]RequiredAt least 1 item.
"post_published""post_failed""approval_requested""approval_decided""account_needs_reconnect"labelstring | nulltagIdstring | nullNarrow the rule to posts carrying this tag. Null (or omitted) means all posts; a tag from another workspace is rejected.
organizationIdstringRequired for session callers with no active organization. Ignored for API keys, which are already scoped to one workspace.
At least 1 character.
curl -X POST "https://orbitwrite.com/api/v1/webhook-endpoints" \
-H "Authorization: Bearer $ORBITWRITE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"url": "string",
"events": [
"post_published"
]
}'{
"ok": true,
"secret": "string",
"endpoint": {
"id": "string",
"label": "string",
"url": "string",
"secretHint": "string",
"events": [
"string"
],
"tagId": "string",
"enabled": true
}
}Requires webhook:update. A paused endpoint keeps its secret and routing but receives nothing.
An API key or OAuth access token as a bearer token, or a signed-in session.
endpointIdstringRequiredAt least 1 character.
organizationIdstringRequired for session callers with no active organization. Ignored for API keys, which are already scoped to one workspace.
At least 1 character.
enabledbooleanRequired200WebhookEndpointMutationResultThe mutation was applied
curl -X POST "https://orbitwrite.com/api/v1/webhook-endpoints/{endpointId}/toggle" \
-H "Authorization: Bearer $ORBITWRITE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"enabled": true
}'{
"ok": true,
"endpoint": {
"id": "string",
"label": "string",
"url": "string",
"secretHint": "string",
"events": [
"string"
],
"tagId": "string",
"enabled": true
}
}The old secret stops verifying immediately (its ciphertext is overwritten) and the new one is surfaced once here and never again, so update the receiver in the same breath. Requires webhook:update — the same authority that can already re-point the endpoint.
An API key or OAuth access token as a bearer token, or a signed-in session.
endpointIdstringRequiredAt least 1 character.
organizationIdstringRequired for session callers with no active organization. Ignored for API keys, which are already scoped to one workspace.
At least 1 character.
curl -X POST "https://orbitwrite.com/api/v1/webhook-endpoints/{endpointId}/regenerate-secret" \
-H "Authorization: Bearer $ORBITWRITE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"organizationId": "string"
}'{
"ok": true,
"secret": "string",
"endpoint": {
"id": "string",
"label": "string",
"url": "string",
"secretHint": "string",
"events": [
"string"
],
"tagId": "string",
"enabled": true
}
}Edits everything except the secret, which rotates through its own route. Requires webhook:update.
Despite the verb this replaces the editable fields rather than merging them: url and events are required, and label and tagId are optional only in the sense that omitting one (or sending null) clears it — it does not leave the stored value alone. Send the endpoint's full desired state.
An API key or OAuth access token as a bearer token, or a signed-in session.
endpointIdstringRequiredAt least 1 character.
urlstringRequiredAt least 1 character.
eventsstring[]RequiredAt least 1 item.
"post_published""post_failed""approval_requested""approval_decided""account_needs_reconnect"labelstring | nulltagIdstring | nullNarrow the rule to posts carrying this tag. Null (or omitted) means all posts; a tag from another workspace is rejected.
organizationIdstringRequired for session callers with no active organization. Ignored for API keys, which are already scoped to one workspace.
At least 1 character.
200WebhookEndpointMutationResultThe mutation was applied
curl -X PATCH "https://orbitwrite.com/api/v1/webhook-endpoints/{endpointId}" \
-H "Authorization: Bearer $ORBITWRITE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"url": "string",
"events": [
"post_published"
]
}'{
"ok": true,
"endpoint": {
"id": "string",
"label": "string",
"url": "string",
"secretHint": "string",
"events": [
"string"
],
"tagId": "string",
"enabled": true
}
}Requires webhook:delete. Deliveries stop immediately and the signing secret goes with the row.
An API key or OAuth access token as a bearer token, or a signed-in session.
endpointIdstringRequiredAt least 1 character.
organizationIdstringSession callers only — an API key already determines the workspace.
At least 1 character.
200WebhookEndpointDeleteResultThe endpoint was removed
okbooleanRequiredcurl -X DELETE "https://orbitwrite.com/api/v1/webhook-endpoints/{endpointId}" \
-H "Authorization: Bearer $ORBITWRITE_API_KEY"{
"ok": true
}