Skip to main content
Registered under Settings → Webhooks. An endpoint is a subscription: it names the events it wants and, optionally, narrows them to part of your traffic.
​
string
required
Where deliveries are POSTed. Must be https, and must answer within 8 seconds.
​
string
Yours, so a list of endpoints stays readable.
​
string
Keys the signature on every delivery. Distinct from your workspace request secret. Returned only to workspace owners.
​
string[]
required
Which types to deliver, drawn from the catalogue below. Required — there is no default, so a type added to the catalogue later never starts arriving here. run.* expands when you save it.
​
string[]
required
Which surfaces to accept: agent, api, mcp, console, playground. Defaults to everything except playground, so test messages never reach a production server.
​
string[]
Only runs that talked to these connections. Empty means every connection. A run whose agent uses no connection is not covered by a connection filter.
​
string[]
Only runs of these agents, by key, so a filter survives publishing a new version. Empty means every agent.
​
string
full or thin. thin omits data, leaving the ids and a reason to read the resource back.
​
boolean
required
An inactive endpoint is skipped without error.
​
string
Why we switched it off, when we did.
​
string
While a rotation is in its overlap window, when the previous secret stops signing.
​
string
Timestamp of the last successful delivery.

​
The catalogue

message.delta and message.block are realtime-only. Requesting a type outside the catalogue is rejected rather than ignored.

​
Delivery

Each delivery is a POST carrying the full event as its body, with three headers: Verify with this endpoint’s secret, using the scheme in Signing and verification, accepting if any v2 matches and rejecting a timestamp more than five minutes old.

​
Retries

Anything 300 or above is a failure, and redirects are not followed. Failures retry immediately, then after 30s, 2m, 10m, 1h and 6h — six attempts over about eight hours — then stop. 410 Gone is treated as “stop sending”: the endpoint is switched off straight away with no retry. Deliveries are not ordered, and a retry can land after a later event. Deduplicate on Patchwork-Delivery and treat each event as a statement about a run you can re-fetch, not as a state machine of its own. See Events and webhooks for the delivery log, replay, test events and secret rotation.