Webhooks

Get notified when analysis completes instead of polling. Pass a callback_url to POST /analyze or POST /correlate, then verify incoming deliveries with your signing secret. These endpoints authenticate with the X-API-Key header.

GET /webhooks/secret X-API-Key

Check whether a webhook signing secret is configured. The returned value is masked (only the first 8 characters are shown) and cannot be used to verify signatures — the full secret is shown only once, when you create or rotate it via POST /webhooks/secret. Returns 404 if no secret has been generated yet.

{
  "data": {
    "webhook_secret": "whsec_12******************",
    "message": "Webhook secret (masked). Use POST /webhooks/secret to generate a new one."
  }
}

POST /webhooks/secret X-API-Key

Generate or rotate your webhook signing secret. Rotating invalidates the previous secret — update your verification code before rotating in production.

{
  "data": {
    "webhook_secret": "whsec_...",
    "message": "Webhook secret rotated"
  }
}

GET /webhooks/{job_id}/status X-API-Key

Inspect delivery status for a job’s webhook: attempt count, last response code, last error, and delivery timestamp. Useful for debugging missed callbacks.

job_id (path, required) — The job whose webhook delivery you want to inspect

{
  "data": {
    "job_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "status": "delivered",
    "attempts": 1,
    "max_attempts": 5,
    "last_attempt_at": "2026-06-30T14:02:13Z",
    "last_response_code": 200,
    "last_error": null,
    "delivered_at": "2026-06-30T14:02:13Z",
    "url": "https://example.com/webhooks/whoisgenius"
  }
}