Create
Register a webhook endpoint for one or more event types. The response carries the signing secret exactly once — verify each delivery’s korve-signature header against it.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
The organization's id (UUID) or slug — either form is accepted.
Body
HTTPS endpoint to deliver events to, e.g. "https://hooks.acme.com/korve". Plain http is refused.
Event types to deliver. At least one; duplicates are ignored.
Platform event type: deploy.failed (a deployment failed), budget.alert (a project passed its budget alert threshold), budget.exceeded (a project reached its monthly budget cap).
deploy.failed, budget.alert, budget.exceeded Response
Webhook registered. secret is the signing secret — shown exactly once; store it securely.
HTTPS endpoint events are POSTed to. Unique per organization.
Event types delivered to this endpoint, in canonical order.
Platform event type: deploy.failed (a deployment failed), budget.alert (a project passed its budget alert threshold), budget.exceeded (a project reached its monthly budget cap).
deploy.failed, budget.alert, budget.exceeded The signing secret deliveries are HMAC'd with. Shown exactly once — it is never retrievable later. Store it with the receiving service.
^whsec_[0-9a-f]{40}$