Manage endpoints

Create webhook endpoints, rotate secrets, and inspect deliveries.

Webhooks notify your systems when posts schedule, publish, or fail. Workspace owners and admins need a session bearer (PATs cannot manage webhooks) and X-Workspace-Id. Max 10 endpoints per workspace.

For a product overview, see the App webhooks guide.

Event catalog

GET /api/webhooks/events

Event types:

• post.scheduled
• post.rescheduled
• post.cancelled
• post.published
• post.publish_failed
• social_account.reconnect_required

Create an endpoint

POST /api/webhooks

curl -X POST https://api.dunsocial.com/api/webhooks \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "X-Workspace-Id: YOUR_WORKSPACE_ID" \
-H "Content-Type: application/json" \
-d '{
  "name": "Production hooks",
  "url": "https://example.com/hooks/dunsocial",
  "events": ["post.published", "post.publish_failed"],
  "enabled": true
}'

Returns 201 with the endpoint and a plain secret once. Store it and verify signatures on your side.

Verify signatures

Every delivery includes:

Verify by recomputing HMAC-SHA256 of the string {timestamp}.{rawBody} with the endpoint secret, then comparing the hex digest to the value after v1=. Reject if the signature mismatches, or if the timestamp is too far from your clock (replay window). Use the raw request body string — re-serializing JSON can change bytes and fail verification.

List, get, update, delete

Secrets

Secrets are returned only when an endpoint is created or rotated. Store the value securely; the current secret cannot be revealed later.

Test and deliveries

POST /api/webhooks/:id/test — sends a test delivery.

GET /api/webhooks/:id/deliveries?status=&eventType=&limit=&offset= — paginated delivery log.