Endpoints

Endpoints belong to a workspace. Every request takes workspace, the workspace slug or id, in the query string for GET and in the JSON body otherwise, including DELETE.

In an API key's access, Webhooks set to Read gives webhooks:read, and Write gives all four. Among the built-in workspace roles, the Owner and Manager hold them. Adding, turning on, testing and resending need an active subscription and fail with 402 without one; Check webhook access tells you before you try.

Only a workspace Owner (or an Owner's API key) can add an endpoint; anyone else gets 403. The exception is an automation app subscribing a member's own Zap or n8n workflow with source set to zapier or n8n: any member with webhooks:create can add those. A signing secret is never available to an API key: it comes back once when the endpoint is added, and after that only the Studio shows or rotates it (rotating needs the Owner role).

Limits

• An endpoint subscribes to up to 20 event types, or to ["*"] for every event.
• A workspace can have up to 10 endpoints added by people or API keys, plus up to 50 with source: "zapier" and 50 with source: "n8n".
• Each URL belongs to one endpoint. To get more events at a URL, add them to its endpoint.
• The URL must be a public https:// address with no username or password in it, on port 443 or 1024 and above.
• An auth header name uses letters, digits and hyphens, and cannot be a header Kalpana sets, such as Content-Type or one starting with Kalpana-. Its value is up to 2000 printable characters.

The endpoint object

{
  "id": "0192f8a4-6c1e-7c3a-9b0e-4d2f1a7e5c11",
  "name": "Zapier: new creatives",
  "description": null,
  "url": "https://hooks.zapier.com/hooks/catch/123/abc/",
  "events": ["batch.completed"],
  "filters": {},
  "format": "json",
  "apiVersion": "2026-10-20",
  "authHeaderName": null,
  "source": "api",
  "enabled": true,
  "disabledAt": null,
  "disabledReason": null,
  "health": { "consecutiveFailures": 0, "failingSince": null },
  "createdAt": "2026-10-20T09:41:07.512Z",
  "updatedAt": "2026-10-20T09:41:07.512Z"
}

• events lists event types, or ["*"] for every event.
• filters is {}, or { "templateIds": [...] } to send only events of those templates.
• format is json, slack, discord or google_chat.
• apiVersion is the payload version the endpoint was created on.
• health.failingSince is set while deliveries keep failing.
• disabledReason says why an endpoint was turned off.
• source is studio or api for endpoints people and API keys add, and zapier or n8n for an automation app's subscription.

The signing secret and the auth header value are never part of this object.

Requests