Endpoints

Create an endpoint

Create a webhook endpoint. The signing secret is returned once.

POST/api/v1/endpoints

cURL

curl -X POST "https://inboundr.net/api/v1/endpoints" \
  -H "Authorization: Bearer $INBOUNDR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "<name>",
    "type": "<type>",
    "url": "<url>",
    "headers": {},
    "timeoutSeconds": 1,
    "maxAttempts": 1
  }'

Creates a webhook endpoint, or a Slack or Discord notification endpoint (see type below). For a webhook, the response includes a secret, prefixed whsec_, which is shown only once. Store it so you can verify signatures. Slack and Discord endpoints have no secret.

namestringbodyrequired

A label for the endpoint (1–100 chars).

typestringbodydefault webhook

webhook, slack or discord. Slack and Discord endpoints post a formatted notification to url (the channel's incoming-webhook URL) instead of raw JSON, and aren't signed. A fourth type, forward, relays mail to a mailbox; it currently returns 403 because outbound sending is turned off.

urlstringbodyrequired

The delivery URL (http or https). It must resolve to a public host; private and internal addresses are rejected. For slack and discord, it must also be on that provider's incoming-webhook host.

headersobjectbody

Up to 10 custom headers sent with every delivery. Reserved headers (Content-Type, X-Inboundr-*, X-Inbound-*, …) can't be overridden.

timeoutSecondsintegerbodydefault 10

Per-request timeout, 1–30 seconds.

maxAttemptsintegerbodydefault 5

Total attempts (first + retries), 1–10.

Example response

201

{
  "id": "ep_123",
  "name": "Production handler",
  "url": "https://api.example.com/hooks/inbound",
  "secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxx",
  "headers": { "X-Team": "growth" },
  "timeoutSeconds": 10,
  "maxAttempts": 5,
  "active": true,
  "createdAt": "2026-07-20T10:00:00.000Z"
}

Copy the secret now. It's only shown when the endpoint is created.