Webhooks

6 operations. {prefix} is the route prefix passed to MapAgentPrism; the template uses /agentprism.

GET {prefix}/api/webhooks

Operation ID: AgentPrismListWebhooks

Lists a tenant’s webhook subscriptions.

The response carries no secret; only the NAME of the signing key is returned.

Authorization: bearer authentication; Admin role policy when that policy is registered; PlatformRead API-key scope.

Response	Body	Headers
200 OK	application/json → array of WebhookSubscription	—

GET {prefix}/api/webhooks/{name}

Operation ID: AgentPrismGetWebhook

Gets a single subscription.

As in the list, no signing secret is returned — only the configuration key its value is read from at delivery time. A secret is never stored in the database and never leaves through this API. An unknown name returns 404.

Authorization: bearer authentication; Admin role policy when that policy is registered; PlatformRead API-key scope.

Parameter	In	Required	Type	Description and rules
name	path	yes	string	—

Response	Body	Headers
200 OK	application/json → WebhookSubscription	—

PUT {prefix}/api/webhooks/{name}

Operation ID: AgentPrismSaveWebhook

Creates or updates a webhook subscription.

The address passes an SSRF check: only https is accepted (http only when AllowInsecureHttp is enabled and only to loopback targets). Private network addresses are re-checked again at delivery time.

Authorization: bearer authentication; Admin role policy when that policy is registered; PlatformAdmin API-key scope.

Parameter	In	Required	Type	Description and rules
name	path	yes	string	—

Request body (required):

• application/json → WebhookSaveRequest

Response	Body	Headers
200 OK	application/json → WebhookSubscription	—

DELETE {prefix}/api/webhooks/{name}

Operation ID: AgentPrismDeleteWebhook

Deletes a subscription and its delivery history.

The delivery history cascades with the subscription, so export it first if it is needed for an audit; there is no way to recover it afterwards. Events raised after the delete match no subscription and are simply not delivered. An unknown name returns 404.

Authorization: bearer authentication; Admin role policy when that policy is registered; PlatformAdmin API-key scope.

Parameter	In	Required	Type	Description and rules
name	path	yes	string	—

Response	Body	Headers
204 No Content	—	—

GET {prefix}/api/webhooks/{name}/deliveries

Operation ID: AgentPrismListWebhookDeliveries

Lists a subscription’s delivery history.

This is a history table, not a queue: scheduling and retry live in the job queue. There is one entry per event, carrying the latest status, the attempt count, and the endpoint’s last response code — a retry updates that entry rather than adding another. Filter with ‘?status=’ to find failures. Paging is offset based — ‘skip’ defaults to 0, ‘take’ to 50, and ‘take’ is clamped to 1..200 instead of being rejected. An unknown subscription name returns 404.

Authorization: bearer authentication; Admin role policy when that policy is registered; PlatformRead API-key scope.

Parameter	In	Required	Type	Description and rules
name	path	yes	string	—
status	query	no	WebhookDeliveryStatus	—
skip	query	no	integer (int32)	pattern `^-?(?:0\
take	query	no	integer (int32)	pattern `^-?(?:0\

Response	Body	Headers
200 OK	application/json → array of WebhookDelivery	—

POST {prefix}/api/webhooks/{name}/test

Operation ID: AgentPrismTestWebhook

Sends a test event to the subscription’s endpoint.

The event is written to the queue and delivered by a background worker; the response reports that it was queued, not the delivery outcome.

Authorization: bearer authentication; Admin role policy when that policy is registered; PlatformAdmin API-key scope.

Parameter	In	Required	Type	Description and rules
name	path	yes	string	—

Response	Body	Headers
200 OK	application/json → WebhookTestResponse	—