Skip to content
Bookrail

Search is only available in production builds. Try building and previewing the site to test it out locally.

Register a webhook endpoint

POST
/v1/webhooks

The only response that ever carries secret. An idempotent replay of the same key answers without it.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters ”
Bookrail-Version

The dated API version to speak. Defaults to 2026-09-01; an unsupported value is a 400.

string
Example
2026-09-01
Bookrail-Actor

Which Bookrail tool the caller is, recorded as actor.via on every event the request writes. A closed list: an unknown value is a 400. Absent means the request declared no tool.

string
Allowed values: mcp cli sdk dashboard
Idempotency-Key

Retry-safety key, 1 to 255 characters. The same key within 24 hours replays the first response, errors included, and never produces a second effect.

string
>= 1 characters <= 255 characters

Request Body required

Section titled “Request Body required ”
object
url
required
string
>= 1 characters <= 2048 characters
events
Array<string>
>= 1 items <= 50 items
description
string | null
<= 500 characters
metadata

Free-form key/value pairs stored with the object and returned untouched.

object
key
additional properties

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Created.

object
id
required

Identifier of a webhook, prefixed with wh_.

string
/^wh_[0-9a-f]{32}$/
Example
wh_0198f0c2a1b47e2e9a1c0f4d5e6a7b8c
object
required
string
Allowed values: webhook
url
required
string
events
required

Subscribed event types. ["*"] means everything, future types included.

Array<string>
status
required
string
Allowed values: active failing disabled
description
required
string | null
metadata
required

Free-form key/value pairs stored with the object and returned untouched.

object
key
additional properties
environment
required

The environment of the API key that created the object.

string
Allowed values: test live
created_at
required

ISO 8601 instant in UTC.

string | null format: date-time
Example
2026-09-08T07:00:00Z
updated_at
required

ISO 8601 instant in UTC.

string | null format: date-time
Example
2026-09-08T07:00:00Z
secret

The signing secret, shown once, in the answer to the request that created the endpoint. Absent from an idempotent replay, and from every other response.

string
Example
whsec_...

Headers

Section titled “Headers ”
Bookrail-Request-Id
required

Identifier of this request. Quote it to support.

string
Bookrail-Version
required

The API version this response was produced with.

string
Idempotent-Replayed

true when the body is the stored answer of an earlier request with the same Idempotency-Key.

string

400

Section titled “400 ”

Error codes: idempotency_key_reused, invalid_body, invalid_webhook_url, parameter_invalid, parameter_missing, unsupported_api_version.

object
error
required
object
type
required
string
Allowed values: invalid_request authentication permission not_found conflict rate_limit policy_violation payment_required internal
code
required

Machine readable code. The set is per operation; each response below lists the ones it can produce.

string
message
required
string
param

The field or header the error is about, when there is one.

string
doc_url
required
string
request_id
required
string

Headers

Section titled “Headers ”
Bookrail-Request-Id
required

Identifier of this request. Quote it to support.

string
Bookrail-Version
required

The API version this response was produced with.

string

401

Section titled “401 ”

Error codes: invalid_api_key, invalid_authorization_header, missing_api_key, revoked_api_key.

object
error
required
object
type
required
string
Allowed values: invalid_request authentication permission not_found conflict rate_limit policy_violation payment_required internal
code
required

Machine readable code. The set is per operation; each response below lists the ones it can produce.

string
message
required
string
param

The field or header the error is about, when there is one.

string
doc_url
required
string
request_id
required
string

Headers

Section titled “Headers ”
Bookrail-Request-Id
required

Identifier of this request. Quote it to support.

string
Bookrail-Version
required

The API version this response was produced with.

string

409

Section titled “409 ”

Error codes: idempotency_key_in_progress.

object
error
required
object
type
required
string
Allowed values: invalid_request authentication permission not_found conflict rate_limit policy_violation payment_required internal
code
required

Machine readable code. The set is per operation; each response below lists the ones it can produce.

string
message
required
string
param

The field or header the error is about, when there is one.

string
doc_url
required
string
request_id
required
string

Headers

Section titled “Headers ”
Bookrail-Request-Id
required

Identifier of this request. Quote it to support.

string
Bookrail-Version
required

The API version this response was produced with.

string

500

Section titled “500 ”

Error codes: internal_error.

object
error
required
object
type
required
string
Allowed values: invalid_request authentication permission not_found conflict rate_limit policy_violation payment_required internal
code
required

Machine readable code. The set is per operation; each response below lists the ones it can produce.

string
message
required
string
param

The field or header the error is about, when there is one.

string
doc_url
required
string
request_id
required
string

Headers

Section titled “Headers ”
Bookrail-Request-Id
required

Identifier of this request. Quote it to support.

string
Bookrail-Version
required

The API version this response was produced with.

string