Add an action to the end of the list

kind defaults to forward, which needs a url. A notify needs an alertChannelId naming one of the workspace's alert channels. A subrequest needs an apiRequestId naming one of the workspace's saved requests, plus a slotMapping covering every field that request declares. Saved requests and their connections are created in the dashboard Library; no API operation lists or creates them, so add a subrequest action once in the dashboard and read its apiRequestId back from listActions.

A kind the plan does not include is refused with code: kind_not_available. A forward url is checked against the same SSRF policy the dispatcher enforces at connect time, so a private or internal address is refused here; a subrequest is checked the same way against its connection's base URL.

Authorization

apiKey

AuthorizationBearer <token>

API key in the Authorization header: Authorization: Bearer wv_live_…. Keys are created on the API keys page in the app, shown once, and scoped to your workspace. X-Api-Key: wv_live_… is accepted as a fallback for tools that can't set Authorization.

In: header

Path Parameters

endpointId*string

The endpoint id (also the capture token in its URL).

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

kind?string

What the action does. Defaults to forward on create. forward POSTs the capture to url; notify sends a message through an alert channel; subrequest sends one of the workspace's saved requests, over its connection, with this endpoint's capture filling the request's fields.

Value in"forward" | "notify" | "subrequest"

name?string

What you call this action. How it is told apart from the others in the dashboard and in delivery records.

Lengthlength <= 200

url?string

Absolute http or https URL for a forward. Private and internal addresses are refused. Ignored by a notify.

Formaturi

Lengthlength <= 2048

isActive?boolean

False pauses the action without deleting it or its transformation rules.

condition?object

Whether this action runs at all, in the same predicate grammar a transformation's when uses. Omit to leave unchanged; send null to clear it back to always. This decides whether a delivery HAPPENS, which a transformation's when cannot: that only decides whether a payload is shaped.

alertChannelId?string

The workspace alert channel a notify sends through. Required for a notify, ignored by a forward. List them with GET /api/v1/alert-channels.

Formatuuid

messageTemplate?string

The message a notify sends, with placeholders resolved against the delivery. A placeholder is a field path in double braces, using the same roots a condition does (body, headers, query, path) - for example New order: {{body.order.reference}} for {{body.customer.name}}. A field the payload does not carry renders empty rather than failing the delivery. Send an empty string to clear it back to a summary of the payload.

Lengthlength <= 1000

apiRequestId?string

The saved request a subrequest sends. Required for a call, ignored by the other kinds.

Formatuuid

slotMapping?

Which of this endpoint's fields fill the request's fields, as an object of field name to path: {"subject": "body.order.reference"}. Paths use the same roots a condition does. EVERY field the request declares must be mapped or the action is refused - a half-mapped call would post a malformed request to a real API and nothing would show that it went wrong. Omit to leave unchanged; send null to clear.

signingSecret?string

Secret a forward signs its deliveries with (the wv-signature header), so the receiver can verify they came from WebhookVault. Write-only: stored protected and never returned; the action reports only whether it is signed and since when. At least 16 characters. Omit to leave unchanged, send an empty string to stop signing, send a value to set or rotate it. Refused on a notify or a subrequest. This replaces the endpoint's deprecated forwardSigningSecret.

Response Body

`application/json`

`application/problem+json`

{
  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  "kind": "forward",
  "name": "string",
  "position": 0,
  "url": "string",
  "isActive": true,
  "suspendedByPlan": true,
  "condition": {},
  "conditionDescription": "string",
  "signing": {
    "signed": true,
    "setAt": "2019-08-24T14:15:22Z"
  },
  "ruleCount": 0,
  "alertChannelId": "48f8dcc3-fd9c-427f-bf34-54017ef3c9a6",
  "alertChannelName": "string",
  "messageTemplate": "string",
  "channelUnavailable": true,
  "apiRequestId": "6ecc081a-ed69-4059-83bc-ec5b8abdbb90",
  "apiRequestName": "string",
  "slotMapping": {
    "property1": "string",
    "property2": "string"
  },
  "requestUnavailable": true
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

Empty

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "string",
  "traceId": "string"
}

Add an action to the end of the list

Authorization

Path Parameters

Request Body

Response Body

201application/json

400application/problem+json

401application/problem+json

403application/problem+json

404application/problem+json

409

429application/problem+json

On this page

`application/json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`

`application/problem+json`