Webhooks

List webhook subscriptions

Returns the list of webhook subscriptions created by the calling API key. Subscriptions created by another key on the same account are NOT visible here (filter client_id AND api_key_id).

No cursor pagination

The maximum of 10 subscriptions per account always fits on a single page. The response returns pagination.next_cursor=null and has_more=false.

Secret never returned

The HMAC secret used to sign outbound payloads is only returned on creation (POST /v1/webhooks). It isn't returned here — to rotate it, delete the subscription and create a new one.

curl -X GET 'https://api.capturia.io/v1/webhooks' \
  -H 'Authorization: Bearer cap_live_<your-key>' \
  -H 'Content-Type: application/json'

Create a webhook subscription

Registers a new subscription. Capturia sends an HMAC-signed JSON POST to url every time a subscribed event occurs.

HTTPS URL required

The URL must use the https:// scheme — http:// is rejected to avoid leaking payloads in cleartext.

Limit of 10 subscriptions per account

Beyond 10 active subscriptions on the same account (across all keys), returns 429 subscription_limit_reached. Delete an existing subscription before you create a new one.

HMAC secret returned only ONCE

The 201 response includes secret in cleartext (64 hex characters, 256 bits of entropy). You MUST store it immediately — you use it to verify the signature of outbound payloads (X-Capturia-Signature), and the API never returns it again. The secret is encrypted in the database after this response.

Scoped to the creating key

The subscription belongs to both the account AND the API key that created it. The GET /v1/webhooks and DELETE /v1/webhooks/{id} endpoints only see the current key's subscriptions — a subscription created by another key on the same account can't be listed or deleted through the API.

curl -X POST 'https://api.capturia.io/v1/webhooks' \
  -H 'Authorization: Bearer cap_live_<your-key>' \
  -H 'Content-Type: application/json' \
  -d '{
  "url": "https://hooks.example.com/capturia",
  "events": [
    "lead_created",
    "payment_received"
  ]
}'

Delete a webhook subscription

Permanently deletes a webhook subscription. The subscription must belong to both the calling account AND the calling API key (filter client_id AND api_key_id) — otherwise 404 not_found.

No soft delete

Deletion is immediate and irreversible — to resume the event stream, create a new subscription with POST /v1/webhooks (a new secret will be issued).

curl -X DELETE 'https://api.capturia.io/v1/webhooks/{id}' \
  -H 'Authorization: Bearer cap_live_<your-key>' \
  -H 'Content-Type: application/json'

List the latest deliverable business events (samples)

Returns the account's latest business events, in exactly the payload shape delivered by a webhook subscription — the same payload builder powers real deliveries and this list.

What it's for

• performList in Zapier/Make apps: when a user tests a trigger, the app shows real recent samples, guaranteed to match what a real delivery will send.
• Integration debugging: inspect what would be delivered without waiting for a new event.

The list combines two sources, from newest to oldest:

• events recorded in the account's delivery queue, with the exact data that was or will be delivered;
• supplemented by events from the activity log that the queue didn't record (no subscription was listening to them at the time), formatted by the same builder.

So it works even when no webhook subscription exists. Events emitted outside the log (lead_updated, note_created, task_created, sms_received, email_sent, call_ended…) only appear once a subscription listens to them: as long as none does, they aren't recorded anywhere. Internal event types (audit) never appear, and sensitive keys in the changes field are redacted just as they are on delivery.

Difference from a real delivery

Each item's id field is the event's identifier at its source — on a real delivery, id is the delivery's unique identifier (X-Capturia-Delivery). The data.system field is always null in a sample: it is resolved at delivery time. The shape and every other field are identical.

No cursor pagination

This is a feed of recent samples, capped at 25 items (limit, default 10). The response returns pagination.next_cursor=null and has_more=false.

curl -X GET 'https://api.capturia.io/v1/webhook-events' \
  -H 'Authorization: Bearer cap_live_<your-key>' \
  -H 'Content-Type: application/json'