Create a webhook endpoint
Register an HTTPS URL to have ICP signal events pushed to it, instead of polling for them.
The signing secret is returned once, in this response, and never again. Store it now: it is what proves a push came from us. Every request carries X-Tamtam-Signature: t=<unix>,v1=<hex hmac-sha256>, computed over <t>.<raw request body>. Verify with a constant-time comparison, and reject a t far from now so a captured request cannot be replayed.
The URL must resolve to a public address. Private, loopback, link-local and cloud-metadata destinations are refused with a 422, at registration and again at delivery time.
Only events detected after this endpoint is registered are pushed to it — registering does not replay your history. Use List ICP signals to backfill.
Several endpoints per account are allowed. Registering the same URL twice returns 409.
Authorizations
Account API key passed in the Authorization header
Query Parameters
Target account UUID. Required for staff callers; ignored for customer API keys.
Body
HTTPS URL to POST events to. Must resolve to a public address: private, loopback, link-local and cloud-metadata destinations are refused.
"https://hooks.example.com/tamtam"
Optional label to tell endpoints apart.
"Salesforce bridge"
Defaults to true. Set false to register without receiving anything yet.
true
Response
OK
When the endpoint was registered. Only events detected after this are ever pushed to it.
Endpoint UUID. Use it to update, delete, or filter deliveries.
When false, nothing is pushed here. Events are unaffected and stay readable from the feed.
The HMAC-SHA256 signing key for this endpoint. Shown once, here, and never again — store it now. Verify every push with it: the X-Tamtam-Signature header is t=,v1=, computed over the string + '.' + the raw request body. Compare with a constant-time function, and reject a timestamp far from now so a captured request cannot be replayed.
"whsec_9f2c"
When the endpoint was last changed.
HTTPS destination events are POSTed to.
"https://hooks.example.com/tamtam"
Free-text label, so several endpoints can be told apart.