Docs

Start here

Challenge it again

POST/v1/webhooks/{id}on https://api.auray.ai/v1

What a disabled endpoint needs after its server is fixed.

What a disabled endpoint needs after its server is fixed. An endpoint paused for failing too many times in a row kept every event it missed queued against it, and a challenge that passes sends them, oldest first; the webhooks guide says how long one is kept.

#Authentication

Authorization: Bearer auray_sk_… — webhooks:write.

#Request

#Path parameters

NameTypeRequiredDescription
idstringyes

#Example request

curl -X POST https://api.auray.ai/v1/webhooks/photo_docs-mtpb1vnh \
  -H "Authorization: Bearer $AURAY_API_KEY"

#Responses

#200 OK

OK

FieldTypeRequiredDefaultDescription
idstringno—
objectstringno—One of "webhook".
urlstringno—A URL.
productsstring[]no—
statusstringno—active if the challenge succeeded just now, pending if it did not. One of "pending", "active".
verifiedbooleanno—
verify_keysstringno—Where the public keys that sign your deliveries are published. Fetch it, cache it, and look up the kid each Auray-Signature names. A URL rather than a key, because a copy handed back here would go stale the moment one is rotated — and free rotation is the point of the scheme. A URL.
signature_algorithmstringno—How Auray-Signature is signed: Ed25519 over <t>.<raw body>, the header reading t=…,v2=…,kid=…. THERE IS NO SHARED SECRET — this response used to return secret (whsec_…) for an HMAC scheme, and the same bytes that verified a delivery could forge one. The private half of this key never leaves the deployment. One key signs for every account, so the body names who it is for, inside what the signature covers: account (your account id, the id GET /v1/me returns) and webhook_id (the endpoint, or null for a per-request ?webhook). Compare account with yours and refuse anything else. One of "EdDSA".
verificationobjectno—Present ONLY when the challenge failed — and the response is still a success, because the endpoint was registered; it is your server that did not answer.
verification.failedstringno—Which check failed.
verification.statusintegerno—The HTTP status your endpoint answered with, if it answered. May be null.
verification.responsestringno—The first bytes of what it said. May be null.
request_idstringno—Mirrored in the X-Request-Id header.

Headers:

HeaderDescription
RateLimit-LimitBurst capacity.
RateLimit-Remaining
RateLimit-ResetSeconds until refill.
X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-ResetUnix seconds. The X- spelling is what client libraries read.
X-Request-Id

#401 Unauthorized

#403 Forbidden

#404 Not Found

#409 Conflict

#429 Too Many Requests

#500 Internal Server Error

webhook_read_failed — your endpoint could not be read. A failed lookup used to answer 404 not_found and send people off to re-register an endpoint that was working. Retry.

The error body: error, message, docs (the entry that explains it) and request_id.

#503 Service Unavailable

#Status codes

StatusMeaning
200OK
401Unauthorized
403Forbidden
404Not Found
409Conflict
429Too Many Requests
500webhook_read_failed — your endpoint could not be read.
503Service Unavailable

Every refusal names its code, and every code is explained at Errors.

Start typing to search every page of the documentation.

Up arrow Down arrow to moveEnter to openEscape to close