Register webhook endpoint

Registers a webhook endpoint that receives control-plane event deliveries. The provided secret is encrypted at rest with AES-256-GCM. The eventTypes array is required and must contain canonical control-plane event constants (str.operation., str.readiness., str.certificate., str.approval.). Idempotent — replaying the same X-Idempotency key with the same body returns the cached response.

POST /v1/str/webhooks

Register webhook endpoint

cURL

curl --request POST \
  --url https://spb.sandbox.lerian.net/v1/str/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Idempotency: <x-idempotency>' \
  --data '
{
  "eventTypes": [
    "str.operation.accepted",
    "str.operation.received"
  ],
  "secret": "whsec_...",
  "url": "https://example.com/webhooks/str-events",
  "isActive": true,
  "metadata": {}
}
'

201

{
  "correlationId": "550e8400-e29b-41d4-a716-446655440001",
  "webhook": {
    "createdAt": "2026-06-14T12:00:00Z",
    "eventTypes": [
      "<string>"
    ],
    "isActive": true,
    "messageTypes": [
      "<string>"
    ],
    "updatedAt": "2026-06-14T12:00:00Z",
    "url": "https://example.com/webhooks/str-events",
    "webhookId": "550e8400-e29b-41d4-a716-446655440000",
    "metadata": {}
  }
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Headers

X-Idempotency · string · required

Idempotency key. Required on every mutation.

X-TTL · string

Idempotency key TTL in seconds (overrides the service default).

Example:

"86400"

Body

application/json

eventTypes · string[] | null · required

Canonical control-plane event types to subscribe to (str.operation., str.readiness., str.certificate., str.approval.); at least one required.

Example:

[
  "str.operation.accepted",
  "str.operation.received"
]

secret · string · required

Shared signing secret (16-512 chars); encrypted at rest with AES-256-GCM and never returned.

Example:

"whsec_..."

url · string · required

HTTPS endpoint that receives event deliveries; max 2048 chars and subject to an SSRF check.

Example:

"https://example.com/webhooks/str-events"

isActive · boolean

Whether the endpoint is active and eligible to receive deliveries; defaults to active when omitted.

metadata · object

Arbitrary client-defined key/value metadata stored with the endpoint.

Show child attributes

Response

201

application/json

Created

correlationId · string · required

Request-scoped correlation identifier echoing X-Request-ID, for pivoting from response to trace.

Example:

"550e8400-e29b-41d4-a716-446655440001"

webhook · object · required

The created, fetched, or updated webhook endpoint.

Show child attributes