Skip to content
iGregulator docs

Create a webhook endpoint, reveal secret once

POST
/v1/webhooks

Validates the URL synchronously against the SSRF blocklist (private IPs, loopback, link-local, cloud-metadata hostnames, IPv6 equivalents). 400 with details.reason=private_ip_blocked if rejected.

Returns the raw signing secret ONCE in the secret field. Subsequent GET /v1/webhooks calls do not include it. Lost the secret? Rotate.

Plan-quota check happens after URL validation. 403 with details.reason=webhook_quota_exceeded when over max_webhook_endpoints.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
object
url
required

Public https URL. Resolved against the SSRF blocklist at creation AND every delivery.

string format: uri
<= 2048 characters
description
string
<= 500 characters
events
required
Array<string>
>= 1 items
Allowed values: license.status_changed license.expiring_30d license.expiring_60d license.expiring_90d license.expired license.issued regulatory_action.added coverage.degraded coverage.restored webhook.endpoint_degraded
watchlist_only

When true (default), tenant-scoped events (license., regulatory_action.) fire only for operators in the caller’s watchlist. Global events (coverage.*, webhook.endpoint_degraded) ignore this flag.

boolean
default: true

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Endpoint created. Note the secret field — visible only here.

object
id
required
string format: uuid
url
required
string format: uri
description
string | null
events
required
Array<string>
Allowed values: license.status_changed license.expiring_30d license.expiring_60d license.expiring_90d license.expired license.issued regulatory_action.added coverage.degraded coverage.restored webhook.endpoint_degraded
active
required
boolean
watchlist_only
required
boolean
created_at
required
string format: date-time
last_delivered_at
string | null format: date-time
last_delivery_status
string | null
Allowed values: success failed retrying
failure_count
integer
secret
required

Raw HMAC-SHA256 signing secret, prefix whsec_. Returned ONCE.

string
whsec_...redacted...

400

Section titled “400 ”

Invalid query / parameters.

object
error
required

Human-readable error summary.

string
code
required

HTTP-status-level class. Stable enum; branch on details.reason for finer control. Current values: invalid_query, invalid_slug, invalid_license_id, invalid_jurisdiction_code, invalid_pagination, not_found, auth_required, auth_invalid, auth_revoked, payment_required, quota_exceeded, rate_limited, server_error.

string
details
required
object
reason
required

Machine-readable refinement of the top-level code. Stable vocabulary; branch on this in clients. Examples: invalid_input, missing_required_parameter, conflicting_parameters, operator_not_found, license_not_found, jurisdiction_not_found, route_not_found, api_key_missing, malformed_header, api_key_invalid, api_key_revoked, quota_exceeded, internal_error.

string
field

Present only when the error maps to a specific request input field (query param, path param, body key). Omitted for errors that aren’t field-scoped (e.g. rate_limited, auth_revoked).

string
suggestion

Optional human-readable / agent-actionable hint describing how to resolve the error.

string
{
  "reason": "api_key_revoked",
  "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
}
{
  "error": "API key has been revoked",
  "code": "auth_revoked",
  "details": {
    "reason": "api_key_revoked",
    "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
  }
}

401

Section titled “401 ”

Missing / malformed / revoked API key.

object
error
required

Human-readable error summary.

string
code
required

HTTP-status-level class. Stable enum; branch on details.reason for finer control. Current values: invalid_query, invalid_slug, invalid_license_id, invalid_jurisdiction_code, invalid_pagination, not_found, auth_required, auth_invalid, auth_revoked, payment_required, quota_exceeded, rate_limited, server_error.

string
details
required
object
reason
required

Machine-readable refinement of the top-level code. Stable vocabulary; branch on this in clients. Examples: invalid_input, missing_required_parameter, conflicting_parameters, operator_not_found, license_not_found, jurisdiction_not_found, route_not_found, api_key_missing, malformed_header, api_key_invalid, api_key_revoked, quota_exceeded, internal_error.

string
field

Present only when the error maps to a specific request input field (query param, path param, body key). Omitted for errors that aren’t field-scoped (e.g. rate_limited, auth_revoked).

string
suggestion

Optional human-readable / agent-actionable hint describing how to resolve the error.

string
{
  "reason": "api_key_revoked",
  "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
}
{
  "error": "API key has been revoked",
  "code": "auth_revoked",
  "details": {
    "reason": "api_key_revoked",
    "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
  }
}

403

Section titled “403 ”

Plan-tier quota reached. Body carries details.reason (watchlist_quota_exceeded / webhook_quota_exceeded) plus current_usage / limit for client-side display.

object
error
required

Human-readable error summary.

string
code
required

HTTP-status-level class. Stable enum; branch on details.reason for finer control. Current values: invalid_query, invalid_slug, invalid_license_id, invalid_jurisdiction_code, invalid_pagination, not_found, auth_required, auth_invalid, auth_revoked, payment_required, quota_exceeded, rate_limited, server_error.

string
details
required
object
reason
required

Machine-readable refinement of the top-level code. Stable vocabulary; branch on this in clients. Examples: invalid_input, missing_required_parameter, conflicting_parameters, operator_not_found, license_not_found, jurisdiction_not_found, route_not_found, api_key_missing, malformed_header, api_key_invalid, api_key_revoked, quota_exceeded, internal_error.

string
field

Present only when the error maps to a specific request input field (query param, path param, body key). Omitted for errors that aren’t field-scoped (e.g. rate_limited, auth_revoked).

string
suggestion

Optional human-readable / agent-actionable hint describing how to resolve the error.

string
{
  "reason": "api_key_revoked",
  "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
}
{
  "error": "API key has been revoked",
  "code": "auth_revoked",
  "details": {
    "reason": "api_key_revoked",
    "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
  }
}

500

Section titled “500 ”

Unexpected server error.

object
error
required

Human-readable error summary.

string
code
required

HTTP-status-level class. Stable enum; branch on details.reason for finer control. Current values: invalid_query, invalid_slug, invalid_license_id, invalid_jurisdiction_code, invalid_pagination, not_found, auth_required, auth_invalid, auth_revoked, payment_required, quota_exceeded, rate_limited, server_error.

string
details
required
object
reason
required

Machine-readable refinement of the top-level code. Stable vocabulary; branch on this in clients. Examples: invalid_input, missing_required_parameter, conflicting_parameters, operator_not_found, license_not_found, jurisdiction_not_found, route_not_found, api_key_missing, malformed_header, api_key_invalid, api_key_revoked, quota_exceeded, internal_error.

string
field

Present only when the error maps to a specific request input field (query param, path param, body key). Omitted for errors that aren’t field-scoped (e.g. rate_limited, auth_revoked).

string
suggestion

Optional human-readable / agent-actionable hint describing how to resolve the error.

string
{
  "reason": "api_key_revoked",
  "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
}
{
  "error": "API key has been revoked",
  "code": "auth_revoked",
  "details": {
    "reason": "api_key_revoked",
    "suggestion": "Generate a new API key at https://app.igregulator.io/settings. Revoked keys cannot be restored."
  }
}