Skip to main content
POST
Create a webhook endpoint

Authorizations

Authorization
string
header
required

Account API key passed in the Authorization header

Query Parameters

account_id
string

Target account UUID. Required for staff callers; ignored for customer API keys.

Body

application/json
url
string
required

HTTPS URL to POST events to. Must resolve to a public address: private, loopback, link-local and cloud-metadata destinations are refused.

Example:

"https://hooks.example.com/tamtam"

description
string

Optional label to tell endpoints apart.

Example:

"Salesforce bridge"

is_enabled
boolean

Defaults to true. Set false to register without receiving anything yet.

Example:

true

Response

OK

created_at
string<date-time>
required

When the endpoint was registered. Only events detected after this are ever pushed to it.

id
string
required

Endpoint UUID. Use it to update, delete, or filter deliveries.

is_enabled
boolean
required

When false, nothing is pushed here. Events are unaffected and stay readable from the feed.

secret
string
required

The HMAC-SHA256 signing key for this endpoint. Shown once, here, and never again — store it now. Verify every push with it: the X-Tamtam-Signature header is t=,v1=, computed over the string + '.' + the raw request body. Compare with a constant-time function, and reject a timestamp far from now so a captured request cannot be replayed.

Example:

"whsec_9f2c"

updated_at
string<date-time>
required

When the endpoint was last changed.

url
string
required

HTTPS destination events are POSTed to.

Example:

"https://hooks.example.com/tamtam"

description
string

Free-text label, so several endpoints can be told apart.