Endpoints and signing secrets

The APIs on this page require alpha access for your organization. App availability and API access are separate. Check access and permissions.

List webhook endpoints

GET /v1/webhook-endpoints

Lists this API key's webhook endpoints, one page at a time. status can be sent more than once to match any of them.

Requires webhooks:read. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: list_webhook_endpoints. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
limit	query	No	integer
cursor	query	No	string
status	query	No	array of "pending_verification", "active", "paused", "disabled"	Repeat this query parameter for multiple values.
name	query	No	string
sort	query	No	"-created_at", "created_at"

Response

HTTP status	Result
200	A page of endpoints.

Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative.

Response field	Type	Required in object	Notes
data	array of WebhookEndpoint	Yes
data[].object	"webhook_endpoint"	Yes
data[].id	string	Yes
data[].version	string	Yes
data[].name	string	Yes
data[].url	string	Yes
data[].status	"pending_verification", "active", "paused", "disabled", "deleted"	Yes
data[].event_types	array of "deduplication.run.finished", "deduplication.ai_assessment_run.finished", "deduplication.ai_assessment_run.needs_attention", "deduplication.plan.ready", "deduplication.plan.authorized", "deduplication.plan.invalidated", "deduplication.execution.finished", "deduplication.execution.needs_attention", "deduplication.set.review_changed", "deduplication.exclusion.changed", "deduplication.schedule.paused", "scheduled_run.sent", "scheduled_run.ended", "scheduled_run_batch.ended"	Yes
data[].resource_filters	array of object	Yes
data[].resource_filters[].family	"deduplication"	Yes	When data[].resource_filters[].family is "deduplication".
data[].resource_filters[].origin	"own_operations", "authorized_resources"	Yes
data[].resource_filters[].object_types	array of "companies", "people"	No	When data[].resource_filters[].family is "deduplication".
data[].resource_filters[].resource_ids	array of string	No	When data[].resource_filters[].family is "deduplication". When data[].resource_filters[].family is "scheduled_runs".
data[].resource_filters[].family	"scheduled_runs"	Yes	When data[].resource_filters[].family is "scheduled_runs".
data[].resource_filters[].target_ids	array of string	No	When data[].resource_filters[].family is "scheduled_runs".
data[].resource_filters[].family	"deduplication_schedules"	Yes	When data[].resource_filters[].family is "deduplication_schedules".
data[].resource_filters[].resource_ids	array of string	Yes	When data[].resource_filters[].family is "deduplication_schedules".
data[].created_at	string (date-time)	Yes
data[].updated_at	string (date-time)	Yes
pagination	object	Yes
pagination.next_cursor	string or null	Yes

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter, invalid_cursor.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required.
404	One of: not_found.
409	One of: already_verified, delivery_in_progress, destination_unavailable, endpoint_inactive, idempotency_conflict, name_taken, secret_required, verification_required, version_conflict.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

Add a webhook endpoint

POST /v1/webhook-endpoints

Adds an endpoint that receives the events you choose. The answer holds the signing secret: store it now, since no read returns it. The endpoint receives events only once it is verified, so send it a test delivery next to verify it. A filter with origin authorized_resources also needs the read scope of what it watches, such as scheduled_runs:read; one with origin own_operations needs no read scope, but this key's access must still cover each target or resource it names. Scan schedules accept only authorized_resources.

Requires webhooks:write. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: create_webhook_endpoint. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
name	JSON body	Yes	string
url	JSON body	Yes	string
event_types	JSON body	Yes	array of "deduplication.run.finished", "deduplication.ai_assessment_run.finished", "deduplication.ai_assessment_run.needs_attention", "deduplication.plan.ready", "deduplication.plan.authorized", "deduplication.plan.invalidated", "deduplication.execution.finished", "deduplication.execution.needs_attention", "deduplication.set.review_changed", "deduplication.exclusion.changed", "deduplication.schedule.paused", "scheduled_run.sent", "scheduled_run.ended", "scheduled_run_batch.ended"
resource_filters	JSON body	Yes	array of object	Name at least one selector: object_types or resource_ids for deduplication, target_ids or resource_ids for scheduled_runs, resource_ids for deduplication_schedules. Selectors within one filter must all match; an event may match any filter. For deduplication_schedules, origin must be authorized_resources.
resource_filters[].family	Within the JSON value	Within this object	"deduplication"	When resource_filters[].family is "deduplication".
resource_filters[].origin	Within the JSON value	Within this object	"own_operations", "authorized_resources"
resource_filters[].object_types	Within the JSON value	No	array of "companies", "people"	When resource_filters[].family is "deduplication".
resource_filters[].resource_ids	Within the JSON value	No	array of string	When resource_filters[].family is "deduplication". When resource_filters[].family is "scheduled_runs".
resource_filters[].family	Within the JSON value	Within this object	"scheduled_runs"	When resource_filters[].family is "scheduled_runs".
resource_filters[].target_ids	Within the JSON value	No	array of string	When resource_filters[].family is "scheduled_runs".
resource_filters[].family	Within the JSON value	Within this object	"deduplication_schedules"	When resource_filters[].family is "deduplication_schedules".
resource_filters[].resource_ids	Within the JSON value	Within this object	array of string	When resource_filters[].family is "deduplication_schedules".
request_key	Header: Idempotency-Key	Yes	string

Response

HTTP status	Result
201	The endpoint and its signing secret. A repeat within a day includes that secret only while it still signs for a live endpoint; otherwise the same control has secret_available false and no secret. A repeat never creates another secret.

Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative.

Response field	Type	Required in object	Notes
data	object	Yes
data.object	"webhook_endpoint_secret"	Yes
data.endpoint_id	string	Yes
data.endpoint_version	string	Yes
data.endpoint_status	"pending_verification", "active", "paused", "disabled", "deleted"	Yes
data.operation_id	string	Yes
data.rotation_id	string or null	Yes
data.secret_available	boolean	Yes
data.secret	string	No
data.previous_secret_expires_at	string (date-time) or null	Yes

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required, plan_required, not_available, resource_forbidden.
404	One of: not_found.
409	One of: idempotency_conflict, name_taken.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

Get a webhook endpoint

GET /v1/webhook-endpoints/{endpoint_id}

Gets one webhook endpoint by its ID.

Requires webhooks:read. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: get_webhook_endpoint. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
endpoint_id	path	Yes	string

Response

HTTP status	Result
200	The endpoint.

Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative.

Response field	Type	Required in object	Notes
data	WebhookEndpoint	Yes
data.object	"webhook_endpoint"	Yes
data.id	string	Yes
data.version	string	Yes
data.name	string	Yes
data.url	string	Yes
data.status	"pending_verification", "active", "paused", "disabled", "deleted"	Yes
data.event_types	array of "deduplication.run.finished", "deduplication.ai_assessment_run.finished", "deduplication.ai_assessment_run.needs_attention", "deduplication.plan.ready", "deduplication.plan.authorized", "deduplication.plan.invalidated", "deduplication.execution.finished", "deduplication.execution.needs_attention", "deduplication.set.review_changed", "deduplication.exclusion.changed", "deduplication.schedule.paused", "scheduled_run.sent", "scheduled_run.ended", "scheduled_run_batch.ended"	Yes
data.resource_filters	array of object	Yes
data.resource_filters[].family	"deduplication"	Yes	When data.resource_filters[].family is "deduplication".
data.resource_filters[].origin	"own_operations", "authorized_resources"	Yes
data.resource_filters[].object_types	array of "companies", "people"	No	When data.resource_filters[].family is "deduplication".
data.resource_filters[].resource_ids	array of string	No	When data.resource_filters[].family is "deduplication". When data.resource_filters[].family is "scheduled_runs".
data.resource_filters[].family	"scheduled_runs"	Yes	When data.resource_filters[].family is "scheduled_runs".
data.resource_filters[].target_ids	array of string	No	When data.resource_filters[].family is "scheduled_runs".
data.resource_filters[].family	"deduplication_schedules"	Yes	When data.resource_filters[].family is "deduplication_schedules".
data.resource_filters[].resource_ids	array of string	Yes	When data.resource_filters[].family is "deduplication_schedules".
data.created_at	string (date-time)	Yes
data.updated_at	string (date-time)	Yes

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, unknown_parameter.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required.
404	One of: not_found.
409	One of: already_verified, delivery_in_progress, destination_unavailable, endpoint_inactive, idempotency_conflict, name_taken, secret_required, verification_required, version_conflict.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

Change, pause or resume a webhook endpoint

PATCH /v1/webhook-endpoints/{endpoint_id}

Changes, pauses or resumes a webhook endpoint. Send the endpoint's version as expected_version. A new URL must be verified again before the endpoint is active. What this replaces is not kept, so it can't be undone.

Requires webhooks:write. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: update_webhook_endpoint. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
endpoint_id	path	Yes	string
expected_version	JSON body	Yes	string
name	JSON body	No	string
url	JSON body	No	string
event_types	JSON body	No	array of "deduplication.run.finished", "deduplication.ai_assessment_run.finished", "deduplication.ai_assessment_run.needs_attention", "deduplication.plan.ready", "deduplication.plan.authorized", "deduplication.plan.invalidated", "deduplication.execution.finished", "deduplication.execution.needs_attention", "deduplication.set.review_changed", "deduplication.exclusion.changed", "deduplication.schedule.paused", "scheduled_run.sent", "scheduled_run.ended", "scheduled_run_batch.ended"
resource_filters	JSON body	No	array of object	Name at least one selector: object_types or resource_ids for deduplication, target_ids or resource_ids for scheduled_runs, resource_ids for deduplication_schedules. Selectors within one filter must all match; an event may match any filter. For deduplication_schedules, origin must be authorized_resources.
resource_filters[].family	Within the JSON value	Within this object	"deduplication"	When resource_filters[].family is "deduplication".
resource_filters[].origin	Within the JSON value	Within this object	"own_operations", "authorized_resources"
resource_filters[].object_types	Within the JSON value	No	array of "companies", "people"	When resource_filters[].family is "deduplication".
resource_filters[].resource_ids	Within the JSON value	No	array of string	When resource_filters[].family is "deduplication". When resource_filters[].family is "scheduled_runs".
resource_filters[].family	Within the JSON value	Within this object	"scheduled_runs"	When resource_filters[].family is "scheduled_runs".
resource_filters[].target_ids	Within the JSON value	No	array of string	When resource_filters[].family is "scheduled_runs".
resource_filters[].family	Within the JSON value	Within this object	"deduplication_schedules"	When resource_filters[].family is "deduplication_schedules".
resource_filters[].resource_ids	Within the JSON value	Within this object	array of string	When resource_filters[].family is "deduplication_schedules".
status	JSON body	No	"active", "paused"
request_key	Header: Idempotency-Key	Yes	string

Response

HTTP status	Result
200	The change is accepted.

Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative.

Response field	Type	Required in object	Notes
data	OperationReceipt	Yes
data.id	string	Yes
data.object	"operation"	Yes
data.version	string	Yes
data.resource_id	string	Yes
data.resource_type	string	Yes
data.status	"pending", "succeeded", "failed", "canceled", "needs_attention"	Yes
data.terminal	boolean	Yes
data.created_at	string (date-time)	Yes
data.ended_at	string (date-time) or null	Yes
data.reason_code	string or null	Yes
data.replayed	true	No
data.operation_type	"scan_cancel", "ai_assessment", "ai_assessment_cancel", "review_update", "exclusion_create", "exclusion_update", "scheduled_batch_create", "scheduled_batch_update", "scheduled_batch_cancel", "scheduled_run_cancel", "scheduled_record_cancel", "schedule_create", "schedule_update", "webhook_endpoint_create", "webhook_endpoint_update", "webhook_secret_rotate", "endpoint_verification", "webhook_replay", "merge_rebuild", "scheduled_batch_transfer", "webhook_endpoint_transfer"	Yes	When data.operation_type is "scan_cancel", "ai_assessment", "ai_assessment_cancel", "review_update", "exclusion_create", "exclusion_update", "scheduled_batch_create", "scheduled_batch_update", "scheduled_batch_cancel", "scheduled_run_cancel", "scheduled_record_cancel", "schedule_create", "schedule_update", "webhook_endpoint_create", "webhook_endpoint_update", "webhook_secret_rotate", "endpoint_verification", "webhook_replay", "merge_rebuild", "scheduled_batch_transfer", "webhook_endpoint_transfer".
data.action_metadata	object	Yes
data.action_metadata.resource_version	string	Yes
data.action_metadata.allowed_actions	array of string	Yes
data.operation_type	"merge_execute", "merge_cancel"	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.action_metadata.execute_not_before	string (date-time)	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.action_metadata.authorization_expires_at	string (date-time)	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.operation_type	"plan_prepare", "plan_revision_prepare", "retry_plan_prepare"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.plan_revision	string	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.effects_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.preview_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.recovery_coverage_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement	object	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.scope	"organization_baseline"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.mode	"api_key_allowed", "not_allowed"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.policy_version	string	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.grant_evaluation	"at_execution"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.reason_code	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_state	"unauthorized", "authorized", "rejected", "invalidated", "expired"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.operation_type	"review_bulk_update", "exclusion_bulk_create"	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results	array of object	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].index	integer	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].outcome	"succeeded", "failed"	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref	object	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref.id	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref.version	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error	object	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.code	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.message	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.param	string	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.operation_type	"scan", "scan_continue"	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child	object	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.state	"not_requested", "pending_admission", "admitted", "skipped", "failed"	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.reason_code	string or null	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.ai_run_id	string	No	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.ai_operation_id	string	No	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.operation_url	string (uri)	No	When data.operation_type is "scan", "scan_continue".

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required, plan_required, not_available, resource_forbidden.
404	One of: not_found.
409	One of: idempotency_conflict, version_conflict, verification_required, name_taken.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

Delete a webhook endpoint

DELETE /v1/webhook-endpoints/{endpoint_id}

Deletes a webhook endpoint; it receives nothing more. Repeating the delete with the same version answers 204 again, so it is safe to retry. This can't be undone.

Requires webhooks:write. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: delete_webhook_endpoint. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
endpoint_id	path	Yes	string
expected_version	query	Yes	string

Response

HTTP status	Result
204	The endpoint is deleted.

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, unknown_parameter.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required.
404	One of: not_found.
409	One of: version_conflict.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

Replace an endpoint's signing secret

POST /v1/webhook-endpoints/{endpoint_id}/secret-rotations

Replaces an endpoint's signing secret. Store the new secret now, since no read returns it. With mode overlap, the default, the current secrets keep signing alongside it until previous_secret_expires_at; with immediate, they stop at once.

Requires webhooks:write. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: rotate_webhook_secret. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
endpoint_id	path	Yes	string
expected_version	JSON body	Yes	string
mode	JSON body	No	"overlap", "immediate"	Default: "overlap".
request_key	Header: Idempotency-Key	Yes	string

Response

HTTP status	Result
201	The endpoint and its new signing secret. A repeat within a day includes that secret only while it still signs for a live endpoint; otherwise the same control has secret_available false and no secret. A repeat never creates another secret.

Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative.

Response field	Type	Required in object	Notes
data	object	Yes
data.object	"webhook_endpoint_secret"	Yes
data.endpoint_id	string	Yes
data.endpoint_version	string	Yes
data.endpoint_status	"pending_verification", "active", "paused", "disabled", "deleted"	Yes
data.operation_id	string	Yes
data.rotation_id	string or null	Yes
data.secret_available	boolean	Yes
data.secret	string	No
data.previous_secret_expires_at	string (date-time) or null	Yes

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required, plan_required, not_available.
404	One of: not_found.
409	One of: idempotency_conflict, version_conflict.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

Send a test delivery to verify an endpoint

POST /v1/webhook-endpoints/{endpoint_id}/verification-attempts

Sends a test delivery to the endpoint's URL to verify it. The endpoint becomes active once it accepts the delivery.

Requires webhooks:write. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: verify_webhook_endpoint. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
endpoint_id	path	Yes	string
expected_version	JSON body	Yes	string
request_key	Header: Idempotency-Key	Yes	string

Response

HTTP status	Result
202	The test delivery is on its way.

Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative.

Response field	Type	Required in object	Notes
data	OperationReceipt	Yes
data.id	string	Yes
data.object	"operation"	Yes
data.version	string	Yes
data.resource_id	string	Yes
data.resource_type	string	Yes
data.status	"pending", "succeeded", "failed", "canceled", "needs_attention"	Yes
data.terminal	boolean	Yes
data.created_at	string (date-time)	Yes
data.ended_at	string (date-time) or null	Yes
data.reason_code	string or null	Yes
data.replayed	true	No
data.operation_type	"scan_cancel", "ai_assessment", "ai_assessment_cancel", "review_update", "exclusion_create", "exclusion_update", "scheduled_batch_create", "scheduled_batch_update", "scheduled_batch_cancel", "scheduled_run_cancel", "scheduled_record_cancel", "schedule_create", "schedule_update", "webhook_endpoint_create", "webhook_endpoint_update", "webhook_secret_rotate", "endpoint_verification", "webhook_replay", "merge_rebuild", "scheduled_batch_transfer", "webhook_endpoint_transfer"	Yes	When data.operation_type is "scan_cancel", "ai_assessment", "ai_assessment_cancel", "review_update", "exclusion_create", "exclusion_update", "scheduled_batch_create", "scheduled_batch_update", "scheduled_batch_cancel", "scheduled_run_cancel", "scheduled_record_cancel", "schedule_create", "schedule_update", "webhook_endpoint_create", "webhook_endpoint_update", "webhook_secret_rotate", "endpoint_verification", "webhook_replay", "merge_rebuild", "scheduled_batch_transfer", "webhook_endpoint_transfer".
data.action_metadata	object	Yes
data.action_metadata.resource_version	string	Yes
data.action_metadata.allowed_actions	array of string	Yes
data.operation_type	"merge_execute", "merge_cancel"	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.action_metadata.execute_not_before	string (date-time)	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.action_metadata.authorization_expires_at	string (date-time)	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.operation_type	"plan_prepare", "plan_revision_prepare", "retry_plan_prepare"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.plan_revision	string	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.effects_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.preview_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.recovery_coverage_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement	object	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.scope	"organization_baseline"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.mode	"api_key_allowed", "not_allowed"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.policy_version	string	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.grant_evaluation	"at_execution"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.reason_code	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_state	"unauthorized", "authorized", "rejected", "invalidated", "expired"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.operation_type	"review_bulk_update", "exclusion_bulk_create"	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results	array of object	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].index	integer	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].outcome	"succeeded", "failed"	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref	object	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref.id	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref.version	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error	object	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.code	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.message	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.param	string	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.operation_type	"scan", "scan_continue"	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child	object	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.state	"not_requested", "pending_admission", "admitted", "skipped", "failed"	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.reason_code	string or null	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.ai_run_id	string	No	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.ai_operation_id	string	No	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.operation_url	string (uri)	No	When data.operation_type is "scan", "scan_continue".

Accepted work can continue after the request returns. Follow its returned status or operation until it finishes; accepting work does not mean every item succeeded. See operation status.

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required, plan_required, not_available.
404	One of: not_found.
409	One of: idempotency_conflict, version_conflict, already_verified, secret_required.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

Give an endpoint to another API key

POST /v1/webhook-endpoints/{endpoint_id}/ownership-transfers

Gives a webhook endpoint to another API key of your organization. Send the endpoint's version as expected_version. The other key's access must cover every filter the endpoint has. The endpoint's signing secrets stop working at once and it stops receiving events until the other key replaces its signing secret and verifies it again. This can't be undone from this key.

Requires webhooks:write. The connection also needs access to the relevant tables, objects, or workflows.

MCP action: transfer_webhook_endpoint. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP.

Parameters

Name	Send in	Required	Type or allowed values	Notes
endpoint_id	path	Yes	string
destination_integration_id	JSON body	Yes	string
expected_version	JSON body	Yes	string
request_key	Header: Idempotency-Key	Yes	string

Response

HTTP status	Result
200	The endpoint moved.

Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative.

Response field	Type	Required in object	Notes
data	OperationReceipt	Yes
data.id	string	Yes
data.object	"operation"	Yes
data.version	string	Yes
data.resource_id	string	Yes
data.resource_type	string	Yes
data.status	"pending", "succeeded", "failed", "canceled", "needs_attention"	Yes
data.terminal	boolean	Yes
data.created_at	string (date-time)	Yes
data.ended_at	string (date-time) or null	Yes
data.reason_code	string or null	Yes
data.replayed	true	No
data.operation_type	"scan_cancel", "ai_assessment", "ai_assessment_cancel", "review_update", "exclusion_create", "exclusion_update", "scheduled_batch_create", "scheduled_batch_update", "scheduled_batch_cancel", "scheduled_run_cancel", "scheduled_record_cancel", "schedule_create", "schedule_update", "webhook_endpoint_create", "webhook_endpoint_update", "webhook_secret_rotate", "endpoint_verification", "webhook_replay", "merge_rebuild", "scheduled_batch_transfer", "webhook_endpoint_transfer"	Yes	When data.operation_type is "scan_cancel", "ai_assessment", "ai_assessment_cancel", "review_update", "exclusion_create", "exclusion_update", "scheduled_batch_create", "scheduled_batch_update", "scheduled_batch_cancel", "scheduled_run_cancel", "scheduled_record_cancel", "schedule_create", "schedule_update", "webhook_endpoint_create", "webhook_endpoint_update", "webhook_secret_rotate", "endpoint_verification", "webhook_replay", "merge_rebuild", "scheduled_batch_transfer", "webhook_endpoint_transfer".
data.action_metadata	object	Yes
data.action_metadata.resource_version	string	Yes
data.action_metadata.allowed_actions	array of string	Yes
data.operation_type	"merge_execute", "merge_cancel"	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.action_metadata.execute_not_before	string (date-time)	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.action_metadata.authorization_expires_at	string (date-time)	Yes	When data.operation_type is "merge_execute", "merge_cancel".
data.operation_type	"plan_prepare", "plan_revision_prepare", "retry_plan_prepare"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.plan_revision	string	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.effects_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.preview_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.recovery_coverage_digest	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement	object	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.scope	"organization_baseline"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.mode	"api_key_allowed", "not_allowed"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.policy_version	string	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.grant_evaluation	"at_execution"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_requirement.reason_code	string or null	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.action_metadata.authorization_state	"unauthorized", "authorized", "rejected", "invalidated", "expired"	Yes	When data.operation_type is "plan_prepare", "plan_revision_prepare", "retry_plan_prepare".
data.operation_type	"review_bulk_update", "exclusion_bulk_create"	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results	array of object	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].index	integer	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].outcome	"succeeded", "failed"	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref	object	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref.id	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].resource_ref.version	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error	object	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.code	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.message	string	Yes	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.action_metadata.results[].error.param	string	No	When data.operation_type is "review_bulk_update", "exclusion_bulk_create".
data.operation_type	"scan", "scan_continue"	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child	object	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.state	"not_requested", "pending_admission", "admitted", "skipped", "failed"	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.reason_code	string or null	Yes	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.ai_run_id	string	No	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.ai_operation_id	string	No	When data.operation_type is "scan", "scan_continue".
data.action_metadata.ai_child.operation_url	string (uri)	No	When data.operation_type is "scan", "scan_continue".

Errors

HTTP status	Meaning
400	One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter.
401	One of: missing_credential, invalid_credential, credential_expired, credential_revoked.
402	One of: payment_overdue.
403	One of: scope_required, plan_required, not_available, resource_forbidden.
404	One of: not_found.
409	One of: idempotency_conflict, version_conflict, destination_unavailable.
410	One of: resource_expired.
413	One of: request_too_large.
422	One of: invalid_url, unsupported_filter.
423	One of: organization_reopening.
428	One of: customer_agreement_required.
429	One of: rate_limited.
503	One of: service_unavailable.

See errors and recovery and safe retries before repeating a write.

The public OpenAPI document lists generally available API families. Alpha operations may not appear in that document; their request and response fields are listed on this page. Use the API Playground to inspect a real response with your connection's access.