A real webhook dispatcher. Register a subscription, trigger an event, and the backend sends an actual HTTP POST to your URL (try https://webhook.site). Inspect delivery attempts, replay failures, and verify the real HMAC-SHA256 payload signature sent in the X-FunAPI-Signature header.
The Webhooks API is the receiving end of the problem: register a callback URL, trigger an event, then inspect exactly what was delivered and replay it. Deliveries are signed with an HMAC, so you can practise verifying a signature — including the constant-time comparison and the replay window that separate a real verifier from a string equality check.
Base URL: https://funapi.dev/api/webhooks/v1 · 7 endpoints · OpenAPI 3.1 spec and Postman collection available. New here? Read the getting started guide.
who gets notified, and for what
POST /webhooks/v1/subscriptions — Register a webhook subscription (requires Bearer auth) · Responds with 201 400 401 Link to this endpointGET /webhooks/v1/subscriptions — List webhook subscriptions (secrets redacted) (requires Bearer auth) · Responds with 200 Link to this endpointDELETE /webhooks/v1/subscriptions/{id} — Unsubscribe (requires Bearer auth) · Responds with 204 401 403 404 Link to this endpointattempts, replays, and signature checks
POST /webhooks/v1/trigger — Fire an event to all matching subscriptions (real HTTP POST) (requires Bearer auth) · Responds with 200 201 400 Link to this endpointGET /webhooks/v1/deliveries — List delivery attempts, filter by status or subscription (requires Bearer auth) · Responds with 200 400 Link to this endpointPOST /webhooks/v1/deliveries/{id}/replay — Replay a delivery attempt — re-sends the real HTTP POST (409 after 3 attempts) (requires Bearer auth) · Responds with 200 401 404 409 Link to this endpointPOST /webhooks/v1/verify-signature — Verify a payload signature (real HMAC-SHA256) · Responds with 200 400 Link to this endpointLast updated