Skip to main content
PATCH
cURL

Authorizations

Authorization
string
header
required

Project-scoped API key, e.g. nohead_sk_k7fz0a9c3m2q_<secret>, or nohead_pk_… for a published-only key. Used by servers, CI, the CLI and coding agents.

Headers

Idempotency-Key
string

A unique value (1-255 printable ASCII characters) that makes retrying this request safe. The first response (below 500) is stored for 24 hours per user or API key; retries with the same key and the same request get it again with an Idempotent-Replayed: true header. The same key with a different request is refused with 400; a retry while the first request is still running gets 409.

Required string length: 1 - 255
Nohead-Client
string

First-party client identifier recorded in history (e.g. cli/0.3.1). Informational only.

Path Parameters

webhook_id
string
required

Body

application/json
url
string
description
string | null
event_types
enum<string>[]
Minimum array length: 1

An event webhooks can subscribe to: the same names as the activity log's actions. A subscription can also be every type of a resource (record.*, draft.*, collection.*, field.*, asset.*) or * for all.

Available options:
record.created,
record.updated,
record.published,
record.unpublished,
record.deleted,
record.restored,
record.reverted,
record.redacted,
record.scheduled,
record.unscheduled,
record.schedule_failed,
draft.created,
draft.updated,
draft.discarded,
draft.scheduled,
draft.unscheduled,
draft.schedule_failed,
collection.created,
collection.updated,
collection.deleted,
collection.restored,
collection.fields_reordered,
field.created,
field.updated,
field.deleted,
field.restored,
field.migrated,
field.alias_removed,
asset.created,
asset.updated,
asset.deleted,
asset.restored,
asset.purged
published_only
boolean

Send only events that change what a published-only API key can read (false by default). It can't be combined with event types it never sends, such as draft.*.

enabled
boolean

Response

The webhook.

id
string
required
Example:

"wh_01J9ZQ3F8X5W2K7M4N6P0R1S2T"

object
any
required
project_id
string
required
url
string<uri>
required
description
string | null
required
event_types
enum<string>[]
required

The subscribed event types and wildcards (record.*, or * for all).

An event webhooks can subscribe to: the same names as the activity log's actions. A subscription can also be every type of a resource (record.*, draft.*, collection.*, field.*, asset.*) or * for all.

Available options:
record.created,
record.updated,
record.published,
record.unpublished,
record.deleted,
record.restored,
record.reverted,
record.redacted,
record.scheduled,
record.unscheduled,
record.schedule_failed,
draft.created,
draft.updated,
draft.discarded,
draft.scheduled,
draft.unscheduled,
draft.schedule_failed,
collection.created,
collection.updated,
collection.deleted,
collection.restored,
collection.fields_reordered,
field.created,
field.updated,
field.deleted,
field.restored,
field.migrated,
field.alias_removed,
asset.created,
asset.updated,
asset.deleted,
asset.restored,
asset.purged
published_only
boolean
required

Send only events that change what a published-only API key can read: a record's change while it is published (or that publishes, unpublishes, deletes or restores it), schema changes, and changes to assets that published records use. Drafts, schedules, history redactions, uploads and purges are never sent. webhook.test always is.

enabled
boolean
required
deleted_at
string<date-time> | null
required

When the webhook was deleted; null unless it is.

purge_after
string<date-time> | null
required

When a deleted webhook is removed for good, with its delivery log, unless restored first.

created_at
string<date-time>
required

ISO 8601 timestamp in UTC.

Example:

"2026-09-27T12:00:00.000Z"

updated_at
string<date-time>
required

ISO 8601 timestamp in UTC.

Example:

"2026-09-27T12:00:00.000Z"