# Endpoints and signing secrets Source: https://neondeerdata.com/docs/api/webhooks/endpoints/ Create and verify webhook endpoints, manage their ownership, and replace signing secrets. The APIs on this page require alpha access for your organization. App availability and API access are separate. [Check access and permissions](https://neondeerdata.com/docs/api/permissions/). ## List webhook endpoints ```http GET /v1/webhook-endpoints ``` Lists this API key's webhook endpoints, one page at a time. status can be sent more than once to match any of them. Requires `webhooks:read`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `list_webhook_endpoints`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | -------- | ------- | -------- | ----------------------------------------------------------------------- | ------------------------------------------------ | | `limit` | query | No | integer | | | `cursor` | query | No | string | | | `status` | query | No | array of `"pending_verification"`, `"active"`, `"paused"`, `"disabled"` | Repeat this query parameter for multiple values. | | `name` | query | No | string | | | `sort` | query | No | `"-created_at"`, `"created_at"` | | ### Response | HTTP status | Result | | ----------- | -------------------- | | `200` | A page of endpoints. | Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative. | Response field | Type | Required in object | Notes | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------- | | `data` | array of WebhookEndpoint | Yes | | | `data[].object` | `"webhook_endpoint"` | Yes | | | `data[].id` | string | Yes | | | `data[].version` | string | Yes | | | `data[].name` | string | Yes | | | `data[].url` | string | Yes | | | `data[].status` | `"pending_verification"`, `"active"`, `"paused"`, `"disabled"`, `"deleted"` | Yes | | | `data[].event_types` | array of `"deduplication.run.finished"`, `"deduplication.ai_assessment_run.finished"`, `"deduplication.ai_assessment_run.needs_attention"`, `"deduplication.plan.ready"`, `"deduplication.plan.authorized"`, `"deduplication.plan.invalidated"`, `"deduplication.execution.finished"`, `"deduplication.execution.needs_attention"`, `"deduplication.set.review_changed"`, `"deduplication.exclusion.changed"`, `"deduplication.schedule.paused"`, `"scheduled_run.sent"`, `"scheduled_run.ended"`, `"scheduled_run_batch.ended"` | Yes | | | `data[].resource_filters` | array of object | Yes | | | `data[].resource_filters[].family` | `"deduplication"` | Yes | When data\[\].resource_filters\[\].family is `"deduplication"`. | | `data[].resource_filters[].origin` | `"own_operations"`, `"authorized_resources"` | Yes | | | `data[].resource_filters[].object_types` | array of `"companies"`, `"people"` | No | When data\[\].resource_filters\[\].family is `"deduplication"`. | | `data[].resource_filters[].resource_ids` | array of string | No | When data\[\].resource_filters\[\].family is `"deduplication"`. When data\[\].resource_filters\[\].family is `"scheduled_runs"`. | | `data[].resource_filters[].family` | `"scheduled_runs"` | Yes | When data\[\].resource_filters\[\].family is `"scheduled_runs"`. | | `data[].resource_filters[].target_ids` | array of string | No | When data\[\].resource_filters\[\].family is `"scheduled_runs"`. | | `data[].resource_filters[].family` | `"deduplication_schedules"` | Yes | When data\[\].resource_filters\[\].family is `"deduplication_schedules"`. | | `data[].resource_filters[].resource_ids` | array of string | Yes | When data\[\].resource_filters\[\].family is `"deduplication_schedules"`. | | `data[].created_at` | string (date-time) | Yes | | | `data[].updated_at` | string (date-time) | Yes | | | `pagination` | object | Yes | | | `pagination.next_cursor` | string or null | Yes | | ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter, invalid_cursor. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required. | | `404` | One of: not_found. | | `409` | One of: already_verified, delivery_in_progress, destination_unavailable, endpoint_inactive, idempotency_conflict, name_taken, secret_required, verification_required, version_conflict. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. ## Add a webhook endpoint ```http POST /v1/webhook-endpoints ``` Adds an endpoint that receives the events you choose. The answer holds the signing secret: store it now, since no read returns it. The endpoint receives events only once it is verified, so send it a test delivery next to verify it. A filter with origin authorized_resources also needs the read scope of what it watches, such as scheduled_runs:read; one with origin own_operations needs no read scope, but this key's access must still cover each target or resource it names. Scan schedules accept only authorized_resources. Requires `webhooks:write`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `create_webhook_endpoint`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | --------------------------------- | ------------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `name` | JSON body | Yes | string | | | `url` | JSON body | Yes | string | | | `event_types` | JSON body | Yes | array of `"deduplication.run.finished"`, `"deduplication.ai_assessment_run.finished"`, `"deduplication.ai_assessment_run.needs_attention"`, `"deduplication.plan.ready"`, `"deduplication.plan.authorized"`, `"deduplication.plan.invalidated"`, `"deduplication.execution.finished"`, `"deduplication.execution.needs_attention"`, `"deduplication.set.review_changed"`, `"deduplication.exclusion.changed"`, `"deduplication.schedule.paused"`, `"scheduled_run.sent"`, `"scheduled_run.ended"`, `"scheduled_run_batch.ended"` | | | `resource_filters` | JSON body | Yes | array of object | Name at least one selector: object_types or resource_ids for deduplication, target_ids or resource_ids for scheduled_runs, resource_ids for deduplication_schedules. Selectors within one filter must all match; an event may match any filter. For deduplication_schedules, origin must be authorized_resources. | | `resource_filters[].family` | Within the JSON value | Within this object | `"deduplication"` | When resource_filters\[\].family is `"deduplication"`. | | `resource_filters[].origin` | Within the JSON value | Within this object | `"own_operations"`, `"authorized_resources"` | | | `resource_filters[].object_types` | Within the JSON value | No | array of `"companies"`, `"people"` | When resource_filters\[\].family is `"deduplication"`. | | `resource_filters[].resource_ids` | Within the JSON value | No | array of string | When resource_filters\[\].family is `"deduplication"`. When resource_filters\[\].family is `"scheduled_runs"`. | | `resource_filters[].family` | Within the JSON value | Within this object | `"scheduled_runs"` | When resource_filters\[\].family is `"scheduled_runs"`. | | `resource_filters[].target_ids` | Within the JSON value | No | array of string | When resource_filters\[\].family is `"scheduled_runs"`. | | `resource_filters[].family` | Within the JSON value | Within this object | `"deduplication_schedules"` | When resource_filters\[\].family is `"deduplication_schedules"`. | | `resource_filters[].resource_ids` | Within the JSON value | Within this object | array of string | When resource_filters\[\].family is `"deduplication_schedules"`. | | `request_key` | Header: `Idempotency-Key` | Yes | string | | ### Response | HTTP status | Result | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `201` | The endpoint and its signing secret. A repeat within a day includes that secret only while it still signs for a live endpoint; otherwise the same control has secret_available false and no secret. A repeat never creates another secret. | Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative. | Response field | Type | Required in object | Notes | | --------------------------------- | --------------------------------------------------------------------------- | ------------------ | ----- | | `data` | object | Yes | | | `data.object` | `"webhook_endpoint_secret"` | Yes | | | `data.endpoint_id` | string | Yes | | | `data.endpoint_version` | string | Yes | | | `data.endpoint_status` | `"pending_verification"`, `"active"`, `"paused"`, `"disabled"`, `"deleted"` | Yes | | | `data.operation_id` | string | Yes | | | `data.rotation_id` | string or null | Yes | | | `data.secret_available` | boolean | Yes | | | `data.secret` | string | No | | | `data.previous_secret_expires_at` | string (date-time) or null | Yes | | ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required, plan_required, not_available, resource_forbidden. | | `404` | One of: not_found. | | `409` | One of: idempotency_conflict, name_taken. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. ## Get a webhook endpoint ```http GET /v1/webhook-endpoints/{endpoint_id} ``` Gets one webhook endpoint by its ID. Requires `webhooks:read`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `get_webhook_endpoint`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | ------------- | ------- | -------- | ---------------------- | ----- | | `endpoint_id` | path | Yes | string | | ### Response | HTTP status | Result | | ----------- | ------------- | | `200` | The endpoint. | Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative. | Response field | Type | Required in object | Notes | | -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------ | | `data` | WebhookEndpoint | Yes | | | `data.object` | `"webhook_endpoint"` | Yes | | | `data.id` | string | Yes | | | `data.version` | string | Yes | | | `data.name` | string | Yes | | | `data.url` | string | Yes | | | `data.status` | `"pending_verification"`, `"active"`, `"paused"`, `"disabled"`, `"deleted"` | Yes | | | `data.event_types` | array of `"deduplication.run.finished"`, `"deduplication.ai_assessment_run.finished"`, `"deduplication.ai_assessment_run.needs_attention"`, `"deduplication.plan.ready"`, `"deduplication.plan.authorized"`, `"deduplication.plan.invalidated"`, `"deduplication.execution.finished"`, `"deduplication.execution.needs_attention"`, `"deduplication.set.review_changed"`, `"deduplication.exclusion.changed"`, `"deduplication.schedule.paused"`, `"scheduled_run.sent"`, `"scheduled_run.ended"`, `"scheduled_run_batch.ended"` | Yes | | | `data.resource_filters` | array of object | Yes | | | `data.resource_filters[].family` | `"deduplication"` | Yes | When data.resource_filters\[\].family is `"deduplication"`. | | `data.resource_filters[].origin` | `"own_operations"`, `"authorized_resources"` | Yes | | | `data.resource_filters[].object_types` | array of `"companies"`, `"people"` | No | When data.resource_filters\[\].family is `"deduplication"`. | | `data.resource_filters[].resource_ids` | array of string | No | When data.resource_filters\[\].family is `"deduplication"`. When data.resource_filters\[\].family is `"scheduled_runs"`. | | `data.resource_filters[].family` | `"scheduled_runs"` | Yes | When data.resource_filters\[\].family is `"scheduled_runs"`. | | `data.resource_filters[].target_ids` | array of string | No | When data.resource_filters\[\].family is `"scheduled_runs"`. | | `data.resource_filters[].family` | `"deduplication_schedules"` | Yes | When data.resource_filters\[\].family is `"deduplication_schedules"`. | | `data.resource_filters[].resource_ids` | array of string | Yes | When data.resource_filters\[\].family is `"deduplication_schedules"`. | | `data.created_at` | string (date-time) | Yes | | | `data.updated_at` | string (date-time) | Yes | | ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, unknown_parameter. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required. | | `404` | One of: not_found. | | `409` | One of: already_verified, delivery_in_progress, destination_unavailable, endpoint_inactive, idempotency_conflict, name_taken, secret_required, verification_required, version_conflict. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. ## Change, pause or resume a webhook endpoint ```http PATCH /v1/webhook-endpoints/{endpoint_id} ``` Changes, pauses or resumes a webhook endpoint. Send the endpoint's version as expected_version. A new URL must be verified again before the endpoint is active. What this replaces is not kept, so it can't be undone. Requires `webhooks:write`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `update_webhook_endpoint`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | --------------------------------- | ------------------------- | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `endpoint_id` | path | Yes | string | | | `expected_version` | JSON body | Yes | string | | | `name` | JSON body | No | string | | | `url` | JSON body | No | string | | | `event_types` | JSON body | No | array of `"deduplication.run.finished"`, `"deduplication.ai_assessment_run.finished"`, `"deduplication.ai_assessment_run.needs_attention"`, `"deduplication.plan.ready"`, `"deduplication.plan.authorized"`, `"deduplication.plan.invalidated"`, `"deduplication.execution.finished"`, `"deduplication.execution.needs_attention"`, `"deduplication.set.review_changed"`, `"deduplication.exclusion.changed"`, `"deduplication.schedule.paused"`, `"scheduled_run.sent"`, `"scheduled_run.ended"`, `"scheduled_run_batch.ended"` | | | `resource_filters` | JSON body | No | array of object | Name at least one selector: object_types or resource_ids for deduplication, target_ids or resource_ids for scheduled_runs, resource_ids for deduplication_schedules. Selectors within one filter must all match; an event may match any filter. For deduplication_schedules, origin must be authorized_resources. | | `resource_filters[].family` | Within the JSON value | Within this object | `"deduplication"` | When resource_filters\[\].family is `"deduplication"`. | | `resource_filters[].origin` | Within the JSON value | Within this object | `"own_operations"`, `"authorized_resources"` | | | `resource_filters[].object_types` | Within the JSON value | No | array of `"companies"`, `"people"` | When resource_filters\[\].family is `"deduplication"`. | | `resource_filters[].resource_ids` | Within the JSON value | No | array of string | When resource_filters\[\].family is `"deduplication"`. When resource_filters\[\].family is `"scheduled_runs"`. | | `resource_filters[].family` | Within the JSON value | Within this object | `"scheduled_runs"` | When resource_filters\[\].family is `"scheduled_runs"`. | | `resource_filters[].target_ids` | Within the JSON value | No | array of string | When resource_filters\[\].family is `"scheduled_runs"`. | | `resource_filters[].family` | Within the JSON value | Within this object | `"deduplication_schedules"` | When resource_filters\[\].family is `"deduplication_schedules"`. | | `resource_filters[].resource_ids` | Within the JSON value | Within this object | array of string | When resource_filters\[\].family is `"deduplication_schedules"`. | | `status` | JSON body | No | `"active"`, `"paused"` | | | `request_key` | Header: `Idempotency-Key` | Yes | string | | ### Response | HTTP status | Result | | ----------- | ----------------------- | | `200` | The change is accepted. | Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative. | Response field | Type | Required in object | Notes | | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `data` | OperationReceipt | Yes | | | `data.id` | string | Yes | | | `data.object` | `"operation"` | Yes | | | `data.version` | string | Yes | | | `data.resource_id` | string | Yes | | | `data.resource_type` | string | Yes | | | `data.status` | `"pending"`, `"succeeded"`, `"failed"`, `"canceled"`, `"needs_attention"` | Yes | | | `data.terminal` | boolean | Yes | | | `data.created_at` | string (date-time) | Yes | | | `data.ended_at` | string (date-time) or null | Yes | | | `data.reason_code` | string or null | Yes | | | `data.replayed` | `true` | No | | | `data.operation_type` | `"scan_cancel"`, `"ai_assessment"`, `"ai_assessment_cancel"`, `"review_update"`, `"exclusion_create"`, `"exclusion_update"`, `"scheduled_batch_create"`, `"scheduled_batch_update"`, `"scheduled_batch_cancel"`, `"scheduled_run_cancel"`, `"scheduled_record_cancel"`, `"schedule_create"`, `"schedule_update"`, `"webhook_endpoint_create"`, `"webhook_endpoint_update"`, `"webhook_secret_rotate"`, `"endpoint_verification"`, `"webhook_replay"`, `"merge_rebuild"`, `"scheduled_batch_transfer"`, `"webhook_endpoint_transfer"` | Yes | When data.operation_type is `"scan_cancel"`, `"ai_assessment"`, `"ai_assessment_cancel"`, `"review_update"`, `"exclusion_create"`, `"exclusion_update"`, `"scheduled_batch_create"`, `"scheduled_batch_update"`, `"scheduled_batch_cancel"`, `"scheduled_run_cancel"`, `"scheduled_record_cancel"`, `"schedule_create"`, `"schedule_update"`, `"webhook_endpoint_create"`, `"webhook_endpoint_update"`, `"webhook_secret_rotate"`, `"endpoint_verification"`, `"webhook_replay"`, `"merge_rebuild"`, `"scheduled_batch_transfer"`, `"webhook_endpoint_transfer"`. | | `data.action_metadata` | object | Yes | | | `data.action_metadata.resource_version` | string | Yes | | | `data.action_metadata.allowed_actions` | array of string | Yes | | | `data.operation_type` | `"merge_execute"`, `"merge_cancel"` | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.action_metadata.execute_not_before` | string (date-time) | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.action_metadata.authorization_expires_at` | string (date-time) | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.operation_type` | `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.plan_revision` | string | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.effects_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.preview_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.recovery_coverage_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement` | object | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.scope` | `"organization_baseline"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.mode` | `"api_key_allowed"`, `"not_allowed"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.policy_version` | string | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.grant_evaluation` | `"at_execution"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.reason_code` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_state` | `"unauthorized"`, `"authorized"`, `"rejected"`, `"invalidated"`, `"expired"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.operation_type` | `"review_bulk_update"`, `"exclusion_bulk_create"` | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results` | array of object | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].index` | integer | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].outcome` | `"succeeded"`, `"failed"` | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref` | object | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref.id` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref.version` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error` | object | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.code` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.message` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.param` | string | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.operation_type` | `"scan"`, `"scan_continue"` | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child` | object | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.state` | `"not_requested"`, `"pending_admission"`, `"admitted"`, `"skipped"`, `"failed"` | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.reason_code` | string or null | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.ai_run_id` | string | No | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.ai_operation_id` | string | No | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.operation_url` | string (uri) | No | When data.operation_type is `"scan"`, `"scan_continue"`. | ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required, plan_required, not_available, resource_forbidden. | | `404` | One of: not_found. | | `409` | One of: idempotency_conflict, version_conflict, verification_required, name_taken. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. ## Delete a webhook endpoint ```http DELETE /v1/webhook-endpoints/{endpoint_id} ``` Deletes a webhook endpoint; it receives nothing more. Repeating the delete with the same version answers 204 again, so it is safe to retry. This can't be undone. Requires `webhooks:write`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `delete_webhook_endpoint`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | ------------------ | ------- | -------- | ---------------------- | ----- | | `endpoint_id` | path | Yes | string | | | `expected_version` | query | Yes | string | | ### Response | HTTP status | Result | | ----------- | ------------------------ | | `204` | The endpoint is deleted. | ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, unknown_parameter. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required. | | `404` | One of: not_found. | | `409` | One of: version_conflict. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. ## Replace an endpoint's signing secret ```http POST /v1/webhook-endpoints/{endpoint_id}/secret-rotations ``` Replaces an endpoint's signing secret. Store the new secret now, since no read returns it. With mode overlap, the default, the current secrets keep signing alongside it until previous_secret_expires_at; with immediate, they stop at once. Requires `webhooks:write`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `rotate_webhook_secret`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | ------------------ | ------------------------- | -------- | -------------------------- | ------------------- | | `endpoint_id` | path | Yes | string | | | `expected_version` | JSON body | Yes | string | | | `mode` | JSON body | No | `"overlap"`, `"immediate"` | Default: "overlap". | | `request_key` | Header: `Idempotency-Key` | Yes | string | | ### Response | HTTP status | Result | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `201` | The endpoint and its new signing secret. A repeat within a day includes that secret only while it still signs for a live endpoint; otherwise the same control has secret_available false and no secret. A repeat never creates another secret. | Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative. | Response field | Type | Required in object | Notes | | --------------------------------- | --------------------------------------------------------------------------- | ------------------ | ----- | | `data` | object | Yes | | | `data.object` | `"webhook_endpoint_secret"` | Yes | | | `data.endpoint_id` | string | Yes | | | `data.endpoint_version` | string | Yes | | | `data.endpoint_status` | `"pending_verification"`, `"active"`, `"paused"`, `"disabled"`, `"deleted"` | Yes | | | `data.operation_id` | string | Yes | | | `data.rotation_id` | string or null | Yes | | | `data.secret_available` | boolean | Yes | | | `data.secret` | string | No | | | `data.previous_secret_expires_at` | string (date-time) or null | Yes | | ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required, plan_required, not_available. | | `404` | One of: not_found. | | `409` | One of: idempotency_conflict, version_conflict. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. ## Send a test delivery to verify an endpoint ```http POST /v1/webhook-endpoints/{endpoint_id}/verification-attempts ``` Sends a test delivery to the endpoint's URL to verify it. The endpoint becomes active once it accepts the delivery. Requires `webhooks:write`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `verify_webhook_endpoint`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | ------------------ | ------------------------- | -------- | ---------------------- | ----- | | `endpoint_id` | path | Yes | string | | | `expected_version` | JSON body | Yes | string | | | `request_key` | Header: `Idempotency-Key` | Yes | string | | ### Response | HTTP status | Result | | ----------- | -------------------------------- | | `202` | The test delivery is on its way. | Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative. | Response field | Type | Required in object | Notes | | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `data` | OperationReceipt | Yes | | | `data.id` | string | Yes | | | `data.object` | `"operation"` | Yes | | | `data.version` | string | Yes | | | `data.resource_id` | string | Yes | | | `data.resource_type` | string | Yes | | | `data.status` | `"pending"`, `"succeeded"`, `"failed"`, `"canceled"`, `"needs_attention"` | Yes | | | `data.terminal` | boolean | Yes | | | `data.created_at` | string (date-time) | Yes | | | `data.ended_at` | string (date-time) or null | Yes | | | `data.reason_code` | string or null | Yes | | | `data.replayed` | `true` | No | | | `data.operation_type` | `"scan_cancel"`, `"ai_assessment"`, `"ai_assessment_cancel"`, `"review_update"`, `"exclusion_create"`, `"exclusion_update"`, `"scheduled_batch_create"`, `"scheduled_batch_update"`, `"scheduled_batch_cancel"`, `"scheduled_run_cancel"`, `"scheduled_record_cancel"`, `"schedule_create"`, `"schedule_update"`, `"webhook_endpoint_create"`, `"webhook_endpoint_update"`, `"webhook_secret_rotate"`, `"endpoint_verification"`, `"webhook_replay"`, `"merge_rebuild"`, `"scheduled_batch_transfer"`, `"webhook_endpoint_transfer"` | Yes | When data.operation_type is `"scan_cancel"`, `"ai_assessment"`, `"ai_assessment_cancel"`, `"review_update"`, `"exclusion_create"`, `"exclusion_update"`, `"scheduled_batch_create"`, `"scheduled_batch_update"`, `"scheduled_batch_cancel"`, `"scheduled_run_cancel"`, `"scheduled_record_cancel"`, `"schedule_create"`, `"schedule_update"`, `"webhook_endpoint_create"`, `"webhook_endpoint_update"`, `"webhook_secret_rotate"`, `"endpoint_verification"`, `"webhook_replay"`, `"merge_rebuild"`, `"scheduled_batch_transfer"`, `"webhook_endpoint_transfer"`. | | `data.action_metadata` | object | Yes | | | `data.action_metadata.resource_version` | string | Yes | | | `data.action_metadata.allowed_actions` | array of string | Yes | | | `data.operation_type` | `"merge_execute"`, `"merge_cancel"` | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.action_metadata.execute_not_before` | string (date-time) | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.action_metadata.authorization_expires_at` | string (date-time) | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.operation_type` | `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.plan_revision` | string | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.effects_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.preview_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.recovery_coverage_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement` | object | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.scope` | `"organization_baseline"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.mode` | `"api_key_allowed"`, `"not_allowed"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.policy_version` | string | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.grant_evaluation` | `"at_execution"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.reason_code` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_state` | `"unauthorized"`, `"authorized"`, `"rejected"`, `"invalidated"`, `"expired"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.operation_type` | `"review_bulk_update"`, `"exclusion_bulk_create"` | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results` | array of object | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].index` | integer | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].outcome` | `"succeeded"`, `"failed"` | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref` | object | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref.id` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref.version` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error` | object | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.code` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.message` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.param` | string | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.operation_type` | `"scan"`, `"scan_continue"` | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child` | object | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.state` | `"not_requested"`, `"pending_admission"`, `"admitted"`, `"skipped"`, `"failed"` | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.reason_code` | string or null | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.ai_run_id` | string | No | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.ai_operation_id` | string | No | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.operation_url` | string (uri) | No | When data.operation_type is `"scan"`, `"scan_continue"`. | Accepted work can continue after the request returns. Follow its returned status or operation until it finishes; accepting work does not mean every item succeeded. See [operation status](https://neondeerdata.com/docs/api/operations/). ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required, plan_required, not_available. | | `404` | One of: not_found. | | `409` | One of: idempotency_conflict, version_conflict, already_verified, secret_required. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. ## Give an endpoint to another API key ```http POST /v1/webhook-endpoints/{endpoint_id}/ownership-transfers ``` Gives a webhook endpoint to another API key of your organization. Send the endpoint's version as expected_version. The other key's access must cover every filter the endpoint has. The endpoint's signing secrets stop working at once and it stops receiving events until the other key replaces its signing secret and verifies it again. This can't be undone from this key. Requires `webhooks:write`. The connection also needs access to the relevant tables, objects, or workflows. MCP action: `transfer_webhook_endpoint`. Its argument names match the fields below; an HTTP header is passed using its argument name in MCP. ### Parameters | Name | Send in | Required | Type or allowed values | Notes | | ---------------------------- | ------------------------- | -------- | ---------------------- | ----- | | `endpoint_id` | path | Yes | string | | | `destination_integration_id` | JSON body | Yes | string | | | `expected_version` | JSON body | Yes | string | | | `request_key` | Header: `Idempotency-Key` | Yes | string | | ### Response | HTTP status | Result | | ----------- | ------------------- | | `200` | The endpoint moved. | Required fields are required within their containing object. Notes identify fields that apply only to a particular response alternative. | Response field | Type | Required in object | Notes | | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `data` | OperationReceipt | Yes | | | `data.id` | string | Yes | | | `data.object` | `"operation"` | Yes | | | `data.version` | string | Yes | | | `data.resource_id` | string | Yes | | | `data.resource_type` | string | Yes | | | `data.status` | `"pending"`, `"succeeded"`, `"failed"`, `"canceled"`, `"needs_attention"` | Yes | | | `data.terminal` | boolean | Yes | | | `data.created_at` | string (date-time) | Yes | | | `data.ended_at` | string (date-time) or null | Yes | | | `data.reason_code` | string or null | Yes | | | `data.replayed` | `true` | No | | | `data.operation_type` | `"scan_cancel"`, `"ai_assessment"`, `"ai_assessment_cancel"`, `"review_update"`, `"exclusion_create"`, `"exclusion_update"`, `"scheduled_batch_create"`, `"scheduled_batch_update"`, `"scheduled_batch_cancel"`, `"scheduled_run_cancel"`, `"scheduled_record_cancel"`, `"schedule_create"`, `"schedule_update"`, `"webhook_endpoint_create"`, `"webhook_endpoint_update"`, `"webhook_secret_rotate"`, `"endpoint_verification"`, `"webhook_replay"`, `"merge_rebuild"`, `"scheduled_batch_transfer"`, `"webhook_endpoint_transfer"` | Yes | When data.operation_type is `"scan_cancel"`, `"ai_assessment"`, `"ai_assessment_cancel"`, `"review_update"`, `"exclusion_create"`, `"exclusion_update"`, `"scheduled_batch_create"`, `"scheduled_batch_update"`, `"scheduled_batch_cancel"`, `"scheduled_run_cancel"`, `"scheduled_record_cancel"`, `"schedule_create"`, `"schedule_update"`, `"webhook_endpoint_create"`, `"webhook_endpoint_update"`, `"webhook_secret_rotate"`, `"endpoint_verification"`, `"webhook_replay"`, `"merge_rebuild"`, `"scheduled_batch_transfer"`, `"webhook_endpoint_transfer"`. | | `data.action_metadata` | object | Yes | | | `data.action_metadata.resource_version` | string | Yes | | | `data.action_metadata.allowed_actions` | array of string | Yes | | | `data.operation_type` | `"merge_execute"`, `"merge_cancel"` | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.action_metadata.execute_not_before` | string (date-time) | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.action_metadata.authorization_expires_at` | string (date-time) | Yes | When data.operation_type is `"merge_execute"`, `"merge_cancel"`. | | `data.operation_type` | `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.plan_revision` | string | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.effects_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.preview_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.recovery_coverage_digest` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement` | object | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.scope` | `"organization_baseline"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.mode` | `"api_key_allowed"`, `"not_allowed"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.policy_version` | string | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.grant_evaluation` | `"at_execution"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_requirement.reason_code` | string or null | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.action_metadata.authorization_state` | `"unauthorized"`, `"authorized"`, `"rejected"`, `"invalidated"`, `"expired"` | Yes | When data.operation_type is `"plan_prepare"`, `"plan_revision_prepare"`, `"retry_plan_prepare"`. | | `data.operation_type` | `"review_bulk_update"`, `"exclusion_bulk_create"` | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results` | array of object | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].index` | integer | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].outcome` | `"succeeded"`, `"failed"` | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref` | object | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref.id` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].resource_ref.version` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error` | object | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.code` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.message` | string | Yes | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.action_metadata.results[].error.param` | string | No | When data.operation_type is `"review_bulk_update"`, `"exclusion_bulk_create"`. | | `data.operation_type` | `"scan"`, `"scan_continue"` | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child` | object | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.state` | `"not_requested"`, `"pending_admission"`, `"admitted"`, `"skipped"`, `"failed"` | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.reason_code` | string or null | Yes | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.ai_run_id` | string | No | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.ai_operation_id` | string | No | When data.operation_type is `"scan"`, `"scan_continue"`. | | `data.action_metadata.ai_child.operation_url` | string (uri) | No | When data.operation_type is `"scan"`, `"scan_continue"`. | ### Errors | HTTP status | Meaning | | ----------- | --------------------------------------------------------------------------------------- | | `400` | One of: credential_in_url, invalid_parameter, invalid_request, unknown_parameter. | | `401` | One of: missing_credential, invalid_credential, credential_expired, credential_revoked. | | `402` | One of: payment_overdue. | | `403` | One of: scope_required, plan_required, not_available, resource_forbidden. | | `404` | One of: not_found. | | `409` | One of: idempotency_conflict, version_conflict, destination_unavailable. | | `410` | One of: resource_expired. | | `413` | One of: request_too_large. | | `422` | One of: invalid_url, unsupported_filter. | | `423` | One of: organization_reopening. | | `428` | One of: customer_agreement_required. | | `429` | One of: rate_limited. | | `503` | One of: service_unavailable. | See [errors and recovery](https://neondeerdata.com/docs/api/errors/) and [safe retries](https://neondeerdata.com/docs/api/requests/) before repeating a write. The [public OpenAPI document](https://neondeerdata.com/docs/api/meta/openapi/) lists generally available API families. Alpha operations may not appear in that document; their request and response fields are listed on this page. Use the [API Playground](https://neondeerdata.com/docs/api/testing/) to inspect a real response with your connection's access.