Webhooks

Outbound subscriptions to the platform's events, their signing secret and the delivery attempts they produced — the largest resource. See the Webhook model, the WebhookDelivery model and Webhook security for HMAC signature validation.

Command	HTTP	Description
webhooks list	GET /webhooks	List subscriptions. Signing secrets are never returned.
webhooks get	GET /webhooks/{id}	Fetch one webhook.
webhooks create	POST /webhooks	Create a subscription. The response carries signing_secret in clear text exactly once.
webhooks upsert	PUT /webhooks	Create or update, matched by id then external_id.
webhooks update	PATCH /webhooks/{id}	Update in place.
webhooks delete	DELETE /webhooks/{id}	Soft-delete.
webhooks test	POST /webhooks/{id}/test	Send a synthetic webhook.ping through the real signing and retry path.
webhooks regenerate-secret	POST /webhooks/{id}/regenerate-secret	Rotate the signing secret — returned once.
webhooks deliveries list	GET /webhooks/{id}/deliveries	Delivery attempts for one webhook.
webhooks deliveries get	GET /webhooks/{id}/deliveries/{deliveryId}	Fetch one delivery, with request/response headers and bodies.
webhooks deliveries replay	POST /webhooks/{id}/deliveries/{deliveryId}/replay	Re-send one delivery with a fresh signature.

Examples

# List active subscriptions for one inbox
kobana inbox webhooks list \
  --params '{"status": "active", "inbox_id": "INBOX_ID"}' \
  --fields "id,label,url,subscribed_events"

# Get one
kobana inbox webhooks get --params '{"id": "WEBHOOK_ID"}'

# Create — save the response, signing_secret only comes back this once
kobana inbox webhooks create \
  --json '{"label": "Order sync", "url": "https://example.com/hooks/kobana", "subscribed_events": ["email.processed"]}' \
  --output webhook.json

# Create or update, matched by external_id
kobana inbox webhooks upsert \
  --json '{"external_id": "order-sync", "url": "https://example.com/hooks/kobana", "subscribed_events": ["email.processed", "webhook.test"]}'

# Update the subscribed events
kobana inbox webhooks update \
  --params '{"id": "WEBHOOK_ID"}' \
  --json '{"subscribed_events": ["email.processed"]}'

# Soft-delete
kobana inbox webhooks delete --params '{"id": "WEBHOOK_ID"}' --dry-run

# Send a test ping
kobana inbox webhooks test --params '{"id": "WEBHOOK_ID"}'

# Rotate the signing secret — save the response, it won't come back again
kobana inbox webhooks regenerate-secret --params '{"id": "WEBHOOK_ID"}' --output new-secret.json

# List delivery attempts
kobana inbox webhooks deliveries list \
  --params '{"id": "WEBHOOK_ID", "status": "failed"}' \
  --fields "id,status,attempt,response_status"

# Inspect one delivery
kobana inbox webhooks deliveries get \
  --params '{"id": "WEBHOOK_ID", "deliveryId": "DELIVERY_ID"}'

# Replay it
kobana inbox webhooks deliveries replay \
  --params '{"id": "WEBHOOK_ID", "deliveryId": "DELIVERY_ID"}'

Next steps

• System events — the events a webhook subscribes to.
• Global flags — --output is worth using on every write here.