# Webhooks

Source: https://kirora.io/docs/api/reference/webhook-endpoints

A webhook is an endpoint of yours that receives Kirora's events, such as `message.delivered`. Each delivery is signed, and a failed one is retried on a schedule, up to eight attempts in all (see [Webhooks](https://kirora.io/docs/api/webhooks#retries)). Verify each request's signature against the raw body before trusting it, and treat delivery as at least once and unordered. See [Webhooks](https://kirora.io/docs/api/webhooks).

## Endpoints

- [List webhooks](https://kirora.io/docs/api/reference/listWebhooks): `GET /v1/webhooks`
- [Create a webhook](https://kirora.io/docs/api/reference/createWebhook): `POST /v1/webhooks`
- [Retrieve a webhook](https://kirora.io/docs/api/reference/getWebhook): `GET /v1/webhooks/{id}`
- [Update a webhook](https://kirora.io/docs/api/reference/updateWebhook): `PATCH /v1/webhooks/{id}`
- [Delete a webhook](https://kirora.io/docs/api/reference/deleteWebhook): `DELETE /v1/webhooks/{id}`
- [Send a test webhook delivery](https://kirora.io/docs/api/reference/testWebhook): `POST /v1/webhooks/{id}/test`
- [Rotate a webhook signing secret](https://kirora.io/docs/api/reference/rotateWebhookSecret): `POST /v1/webhooks/{id}/rotate-secret`
- [List webhook deliveries](https://kirora.io/docs/api/reference/listWebhookDeliveries): `GET /v1/webhooks/deliveries`
- [Retrieve a webhook delivery](https://kirora.io/docs/api/reference/getWebhookDelivery): `GET /v1/webhooks/deliveries/{id}`
- [Redeliver a webhook delivery](https://kirora.io/docs/api/reference/redeliverWebhookDelivery): `POST /v1/webhooks/deliveries/{deliveryId}/redeliver`
- [List webhook events](https://kirora.io/docs/api/reference/listWebhookEvents): `GET /v1/webhooks/events`

## The Webhook object

```json
{
  "id": "0192f3f1-2b3c-7d4e-9f50-6b7c8d9e0f1a",
  "url": "https://hooks.acme-shop.com/kirora",
  "events": [
    "contact.created",
    "contact.unsubscribed"
  ],
  "source": null,
  "status": "active",
  "previousSecretExpiresAt": null,
  "createdAt": "2026-10-01T09:30:00.000Z"
}
```

- `id` (string, required, uuid)
- `url` (string, required, uri)
- `events` (string[], required) — The event types it receives.
- `source` (string | null, required, one of `zapier`, `make`, `n8n`) — The integration that created it; null when created directly.
- `status` (string, required, one of `active`, `paused`, `disabled`) — `disabled` is set only by the platform; `active` re-enables it.
- `previousSecretExpiresAt` (string | null, required, date-time) — Until when the replaced secret still signs requests after a rotation.
- `createdAt` (string, required, date-time)