Webhooks

Webhook endpoints receive signed HTTP POSTs from SurfacedBy whenever events you subscribed to occur (scan lifecycle, credit top-ups, key activity). The register endpoint returns a signing secret exactly once; store it immediately, because the system cannot show it to you again. The per-endpoint GET returns delivery stats and a tail of recent attempts so you can debug without leaving the Console.

For the full event catalog and signature-verification algorithm, see Webhooks.

curl -X GET "https://example.com/webhooks" \
  -H "X-API-Key: string"

null

curl -X POST "https://example.com/webhooks" \
  -H "X-API-Key: string" \
  -H "Content-Type: application/json" \
  -d '{}'

null

curl -X GET "https://example.com/webhooks/string" \
  -H "X-API-Key: string"

null

curl -X DELETE "https://example.com/webhooks/string" \
  -H "X-API-Key: string"

null