WebHooks

List all webhooks

get

Retrieves all webhook configurations for the current account. Returns detailed information about each webhook including: - Webhook ID and name - URL endpoint - Subscribed events - Active/inactive status - Creation and last update timestamps - Delivery statistics (success/failure counts)

Only webhooks belonging to the authenticated user's account are returned. Requires owner role to view webhook configurations.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Responses

200

List of webhooks.

application/json

401

User is not authorized to list webhooks.

get

/sfp/api/webhooks

HTTPcURLJavaScriptPython

GET /sfp/api/webhooks HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "name": "Deploy to Production",
    "event": "release.published",
    "provider": "github",
    "config": {
      "url": "text",
      "method": "get",
      "headers": {},
      "filter": {}
    },
    "timeout": 10000,
    "retryCount": 3,
    "retryDelay": 60000,
    "status": "active",
    "lastDeliveryAt": "2025-01-22T07:42:09.000Z",
    "errorCount": 0,
    "createdBy": "[email protected]",
    "createdAt": "2025-01-22T07:42:09.000Z",
    "updatedAt": "2025-01-22T07:42:09.000Z"
  }
]

Delete a webhook

delete

Permanently deletes a webhook configuration. This action: - Stops all future event deliveries to this webhook - Cancels any pending retries for failed deliveries - Removes the webhook configuration from the system - Retains historical delivery logs for audit purposes

This operation cannot be undone. The webhook must belong to the authenticated user's account. Requires owner role.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Webhook ID

Responses

204

The webhook has been successfully deleted.

401

User is not authorized to delete webhooks.

404

Webhook not found.

delete

/sfp/api/webhooks/{id}

HTTPcURLJavaScriptPython

DELETE /sfp/api/webhooks/{id} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Update a webhook

patch

Updates an existing webhook configuration. All fields are optional - only provided fields will be updated. Common updates include: - Changing the endpoint URL - Adding/removing subscribed events - Updating authentication headers - Enabling/disabling the webhook - Modifying retry configuration

The webhook must belong to the authenticated user's account. Updates take effect immediately for new event deliveries. Requires owner role.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Webhook ID

Body

application/json

namestringOptional

A human-readable name for the webhook

Example: Deploy to Production

eventstringOptional

The event that triggers this webhook

Example: release.published

timeoutnumberOptional

Timeout in milliseconds

Example: 10000

retryCountnumberOptional

Number of retry attempts

Example: 3

retryDelaynumberOptional

Delay between retries in milliseconds

Example: 60000

statusstring · enumOptional

Current status of the webhook

Example: activePossible values:

Responses

200

The webhook has been successfully updated.

application/json

400

Invalid webhook configuration.

401

User is not authorized to update webhooks.

404

Webhook not found.

patch

/sfp/api/webhooks/{id}

HTTPcURLJavaScriptPython

PATCH /sfp/api/webhooks/{id} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 145

{
  "config": {
    "url": "https://new-api.example.com/webhook",
    "method": "post",
    "headers": {
      "Content-Type": "application/json",
      "X-New-Header": "new-value"
    }
  }
}

Update Webhook ConfigurationUpdate Webhook Status

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "name": "Deploy to Production",
  "event": "release.published",
  "provider": "github",
  "config": {
    "url": "text",
    "method": "get",
    "headers": {},
    "filter": {}
  },
  "timeout": 10000,
  "retryCount": 3,
  "retryDelay": 60000,
  "status": "active",
  "lastDeliveryAt": "2025-01-22T07:42:09.000Z",
  "errorCount": 0,
  "createdBy": "[email protected]",
  "createdAt": "2025-01-22T07:42:09.000Z",
  "updatedAt": "2025-01-22T07:42:09.000Z"
}

Get a webhook by ID

get

Retrieves detailed information about a specific webhook configuration. Returns comprehensive webhook details including: - Complete configuration (URL, headers, events) - Delivery statistics and recent delivery history - Active/inactive status and last state change - Retry configuration and backoff settings

This endpoint is useful for debugging webhook delivery issues or verifying webhook configuration. Requires owner role.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Webhook ID

Responses

200

The webhook configuration.

application/json

401

User is not authorized to view webhooks.

404

Webhook not found.

get

/sfp/api/webhooks/{id}

HTTPcURLJavaScriptPython

GET /sfp/api/webhooks/{id} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "name": "Deploy to Production",
  "event": "release.published",
  "provider": "github",
  "config": {
    "url": "text",
    "method": "get",
    "headers": {},
    "filter": {}
  },
  "timeout": 10000,
  "retryCount": 3,
  "retryDelay": 60000,
  "status": "active",
  "lastDeliveryAt": "2025-01-22T07:42:09.000Z",
  "errorCount": 0,
  "createdBy": "[email protected]",
  "createdAt": "2025-01-22T07:42:09.000Z",
  "updatedAt": "2025-01-22T07:42:09.000Z"
}

Queue webhooks for an event

post

Triggers webhook deliveries for all active webhooks subscribed to a specific event. This endpoint: - Finds all active webhooks subscribed to the specified event - Queues the payload for delivery to each matching webhook - Processes deliveries asynchronously with configured retry policies - Returns delivery IDs for tracking each webhook delivery

This is the primary mechanism for event-driven webhook notifications in the system. Useful for manual event triggering or system integrations. Requires owner or application role.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

application/json

eventstringRequired

The event that triggers the webhooks

Example: document.created

payloadobjectRequired

The event payload

Example: {"id":"doc123","name":"example.md","type":"markdown","createdBy":"[email protected]"}

Responses

202

Webhook deliveries have been queued

application/json

post

/sfp/api/webhooks/trigger

HTTPcURLJavaScriptPython

POST /sfp/api/webhooks/trigger HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 109

{
  "event": "user.created",
  "payload": {
    "userId": "123",
    "action": "created",
    "timestamp": "2026-01-22T03:27:03.225Z"
  }
}

202

Webhook deliveries have been queued

[
  {
    "success": true,
    "statusCode": 1,
    "error": "text",
    "duration": 1,
    "message": "text",
    "providerDetails": {
      "method": "get",
      "url": "text",
      "headers": {},
      "filtered": true,
      "queued": true,
      "deliveryId": "text",
      "notFound": true,
      "eventName": "text",
      "webhookId": "text",
      "reason": "text",
      "response": {}
    }
  }
]

Create a new webhook

post

Creates a new webhook configuration for receiving notifications about system events. Webhooks allow external systems to be notified when specific events occur within the SFP platform.

The webhook configuration includes:
- URL endpoint to receive HTTP POST requests
- Events to subscribe to (e.g., deployment.started, deployment.completed)
- Optional headers for authentication
- Active/inactive status
- Retry configuration for failed deliveries

Each webhook is associated with the creating account and can only be managed by users with owner role in that account.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

application/json

repositoryIdentifierstringRequired

Repository identifier in format owner/repo

Example: octocat/hello-world

webhookUrlstringRequired

URL where GitHub should send webhook events

Example: https://example.com/webhook

Responses

201

The webhook has been successfully created.

application/json

400

Invalid webhook configuration.

401

User is not authorized to create webhooks.

post

/sfp/api/webhooks

HTTPcURLJavaScriptPython

POST /sfp/api/webhooks HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 206

{
  "name": "Simple Webhook",
  "event": "user.created",
  "provider": "http",
  "config": {
    "url": "https://api.example.com/webhook",
    "method": "post",
    "headers": {
      "Content-Type": "application/json",
      "X-API-Key": "your-api-key"
    }
  }
}

Simple HTTP WebhookFiltered HTTP WebhookCustom Method Webhook

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "name": "Deploy to Production",
  "event": "release.published",
  "provider": "github",
  "config": {
    "url": "text",
    "method": "get",
    "headers": {},
    "filter": {}
  },
  "timeout": 10000,
  "retryCount": 3,
  "retryDelay": 60000,
  "status": "active",
  "lastDeliveryAt": "2025-01-22T07:42:09.000Z",
  "errorCount": 0,
  "createdBy": "[email protected]",
  "createdAt": "2025-01-22T07:42:09.000Z",
  "updatedAt": "2025-01-22T07:42:09.000Z"
}

Queue a payload for delivery to a webhook

post

Manually queues a custom payload for delivery to a specific webhook. This endpoint is useful for: - Testing webhook connectivity and payload handling - Replaying failed deliveries with corrected data - Sending custom notifications outside normal event flow

The payload is queued for asynchronous delivery and will follow the webhook's retry configuration if delivery fails. Returns a delivery ID for tracking. Requires owner or application role.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Webhook ID

Body

application/json

payloadobjectRequired

The payload to deliver to the webhook endpoint

Example: {"event":"deployment","environment":"production","status":"success"}

Responses

202

Webhook delivery has been queued

application/json

post

/sfp/api/webhooks/{id}/deliver

HTTPcURLJavaScriptPython

POST /sfp/api/webhooks/{id}/deliver HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 104

{
  "payload": {
    "event": "user.notification",
    "message": "Hello World",
    "timestamp": "2026-01-22T03:27:03.225Z"
  }
}

Simple PayloadComplex Nested Payload

202

Webhook delivery has been queued

{
  "success": true,
  "statusCode": 1,
  "error": "text",
  "duration": 1,
  "message": "text",
  "providerDetails": {
    "method": "get",
    "url": "text",
    "headers": {},
    "filtered": true,
    "queued": true,
    "deliveryId": "text",
    "notFound": true,
    "eventName": "text",
    "webhookId": "text",
    "reason": "text",
    "response": {}
  }
}

Get webhooks for a repository

get

Retrieves all webhooks configured for the specified repository. Returns detailed information about each webhook including: - GitHub webhook ID and internal ID - Webhook URL endpoint - Events that trigger the webhook - Active status - Creation and last update timestamps

This endpoint helps verify webhook configuration and troubleshoot webhook delivery issues. Requires owner role to view webhook configurations.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

repositoryIdentifierstringRequired

Responses

200

List of webhooks for the repository

application/json

get

/sfp/api/repository/webhook/{repositoryIdentifier}

HTTPcURLJavaScriptPython

GET /sfp/api/repository/webhook/{repositoryIdentifier} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

200

List of webhooks for the repository

[]

Create a webhook for a repository

post

Creates a GitHub webhook for the specified repository to enable real-time event notifications. The webhook listens for a predefined set of events relevant to the SFP application: - pull_request: Tracks PR creation, updates, merges, and closures - pull_request_review: Monitors review submissions and changes - pull_request_review_comment: Captures inline code review comments - issue_comment: Tracks comments on both issues and pull requests - issues: Monitors issue lifecycle events

A webhook secret is automatically generated if one doesn't exist for the repository. This secret is used to verify the authenticity of incoming webhook payloads. The secret is only returned in the response if it was newly generated.

Requires owner role to create webhooks.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

application/json

repositoryIdentifierstringRequired

Repository identifier in format owner/repo

Example: octocat/hello-world

webhookUrlstringRequired

URL where GitHub should send webhook events

Example: https://example.com/webhook

Responses

201

The webhook has been successfully created

application/json

post

/sfp/api/repository/webhook/create

HTTPcURLJavaScriptPython

POST /sfp/api/repository/webhook/create HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 89

{
  "repositoryIdentifier": "octocat/hello-world",
  "webhookUrl": "https://example.com/webhook"
}

201

The webhook has been successfully created

{
  "id": 1,
  "url": "text",
  "events": [
    "text"
  ],
  "active": true,
  "secret": "text"
}

Update a webhook for a repository

post

Updates an existing GitHub webhook's URL for the specified repository. The webhook must already exist for this repository. The events that trigger the webhook and its active status remain unchanged - only the URL is updated.

This is useful when changing the webhook endpoint URL (e.g., after infrastructure changes) without needing to recreate the entire webhook configuration.

The existing webhook secret is reused for security continuity. Requires owner role to update webhooks.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Body

application/json

repositoryIdentifierstringRequired

Repository identifier in format owner/repo

Example: octocat/hello-world

webhookUrlstringRequired

URL where GitHub should send webhook events

Example: https://example.com/webhook

Responses

200

The webhook has been successfully updated

application/json

post

/sfp/api/repository/webhook/update

HTTPcURLJavaScriptPython

POST /sfp/api/repository/webhook/update HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 89

{
  "repositoryIdentifier": "octocat/hello-world",
  "webhookUrl": "https://example.com/webhook"
}

200

The webhook has been successfully updated

{
  "id": 1,
  "url": "text",
  "events": [
    "text"
  ],
  "active": true
}

Delete a webhook for a repository

delete

Permanently deletes a webhook for the specified repository. This operation: - Removes the webhook from GitHub, stopping all event deliveries - Deletes the webhook metadata from the SFP database - Does not delete the webhook secret (which may be reused if webhook is recreated)

If no webhook exists for the repository, the operation succeeds silently. This is useful for cleanup operations. Requires owner role to delete webhooks.

Authorizations

access-token

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

repositoryIdentifierstringRequired

Responses

204

The webhook has been successfully deleted

delete

/sfp/api/repository/webhook/{repositoryIdentifier}

HTTPcURLJavaScriptPython

DELETE /sfp/api/repository/webhook/{repositoryIdentifier} HTTP/1.1
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

204

The webhook has been successfully deleted

No content

Handle incoming webhook events

post

Processes incoming GitHub webhook events. This is the endpoint that GitHub calls when events occur in the repository. The endpoint: - Validates the webhook signature using the repository's secret - Extracts event type and delivery ID from GitHub headers - Routes the event to appropriate handlers based on event type - Processes events asynchronously to avoid blocking GitHub

Supported events are automatically handled by registered handlers. This is a public endpoint as it needs to be accessible by GitHub's webhook delivery system. Authentication is performed via webhook signature validation.

Header parameters

x-github-eventstringRequired

x-github-deliverystringRequired

x-hub-signature-256stringRequired

Responses

200

The webhook event has been processed successfully

No content

post

/sfp/api/repository/webhook

HTTPcURLJavaScriptPython

POST /sfp/api/repository/webhook HTTP/1.1
x-github-event: text
x-github-delivery: text
x-hub-signature-256: text
Accept: */*

200

The webhook event has been processed successfully

No content