Webhooks
Add a webhook endpoint
Flung POSTs each subscribed event to the URL, signed to the Standard Webhooks spec with the returned secret, and retries failures with backoff for about 15 hours.
POST
/v1/webhook-endpointsTL;DR
| Question | Answer |
|---|---|
| What does it do? | Add a webhook endpoint. |
| What does it need? | An API key or an OAuth access token. |
| What does it take? | A JSON body with the fields below, and idempotency-key in a header. |
| What does it return? | Status 201 with a body of type CreatedWebhookEndpoint. |
| In the SDK? | flung.webhookEndpoints.create() |
| What can go wrong? | 401 Missing, unknown, revoked or expired API key; 422 The request failed validation; 429 Too many requests for this credential; wait for retry-after seconds. Every failure has the same error shape. |
Example
bash
curl -X POST 'https://api.flung.dev/v1/webhook-endpoints' \ --header "Authorization: Bearer $FLUNG_API_KEY" \ --header 'Content-Type: application/json' \ --header "Idempotency-Key: $(uuidgen)" \ --data '{ "url": "https://example.com/webhooks/flung", "events": [ "post.published", "post.failed" ]}'ts
import { Flung } from '@flung.dev/sdk'
const flung = new Flung({ apiKey: process.env.FLUNG_API_KEY! })const result = await flung.webhookEndpoints.create({ url: 'https://example.com/webhooks/flung', events: [ 'post.published', 'post.failed', ],})js
const response = await fetch('https://api.flung.dev/v1/webhook-endpoints', { method: 'POST', headers: { 'Authorization': `Bearer ${process.env.FLUNG_API_KEY}`, 'Content-Type': 'application/json', 'Idempotency-Key': crypto.randomUUID(), }, body: JSON.stringify({ url: 'https://example.com/webhooks/flung', events: [ 'post.published', 'post.failed', ], }),})if (!response.ok) throw new Error((await response.json()).error.message)const result = await response.json()A successful answer looks like this:
json
{ "id": "whe_aaaaaaaaaaaaaaaaaaaaaaaa", "url": "string", "events": [ "string" ], "enabled": true, "createdAt": "2026-11-01T09:00:00.000Z", "secret": "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw"}Header parameters
| Field | Type | Required | Description |
|---|---|---|---|
idempotency-key | string | no | Any unique string, such as a UUID. A retry with the same key and body within 24 hours gets the first answer instead of running again. |
Request body
The body has the type an object, with the fields below.
| Field | Type | Required | Description |
|---|---|---|---|
url | string | yes | at most 2048 characters. |
events | WebhookEvent[] | yes |
Responses
| Status | Meaning | Body |
|---|---|---|
| 201 | The endpoint, with its signing secret. | CreatedWebhookEndpoint |
| 401 | Missing, unknown, revoked or expired API key. | Error |
| 422 | The request failed validation. | Error |
| 429 | Too many requests for this credential; wait for retry-after seconds. | Error |
Response body
A 201 answer has the type CreatedWebhookEndpoint.
| Field | Type | Required | Description |
|---|---|---|---|
id | string | yes | |
url | string | yes | |
events | string[] | yes | |
enabled | boolean | yes | |
createdAt | string | yes | |
secret | string | yes | The signing secret (Standard Webhooks, whsec_...). Shown only in this response; store it now. |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint |
| Schemas | Every request and response type |
| Errors | Every error code and what to do about it |