Skip to main content
The Webhooks API manages where Prava sends event notifications and lets you recover anything your receiver missed. For how events are signed, retried and ordered, see the Webhooks guide.

​
Base URLs and authentication

Authenticate every request with your application’s secret key:
The key determines the application and environment. You can’t act on another application’s endpoints or events, and request bodies never take an owner. A secret key controls the application’s webhook configuration, so don’t share it with read-only team members.

​
Resources

​
Conventions

Idempotency. Create endpoint, rotate signing secret and replay delivery require an Idempotency-Key header of 8–120 letters, digits, underscores or hyphens. Reuse the same key when you retry the same request. Reusing a key with different input returns a conflict. Signing secrets. A whsec_… secret is returned only in the original successful create or rotate response. A retried request reports completion without returning the secret again, so store it when you first receive it. Pagination. List deliveries and List events return up to 50 items and a next_cursor. Pass it unchanged as cursor, URL-encoded, to get the next page, keeping the same filters. It’s null on the last page. Requests without a body. For operations that take no payload, omit Content-Type: application/json. Send that header only when you send a JSON body. Errors. Errors use { "error": { "code": "...", "message": "..." } }.

​
Limits

See Webhook errors for the error objects inside event payloads.