Receive webhooks

A source is an address that receives webhooks from any sender. Create one for each service that sends you webhooks, so you can see and route each sender’s webhooks on their own.

Create a source

A source needs only a name, unique in the project:

curl -X POST "$HOOKS_URL/sources" \
  -H "Authorization: Bearer $HOOKS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Mobile money payments" }'

{
  "data": {
    "id": "01m3m4v8kq0c6f3qg2x7w9d1ne",
    "projectId": "01k5ztq3jb9y2a1m9v2xw8e0ha",
    "name": "Mobile money payments",
    "url": "https://hooks.digitospace.com/in/src_k7m2q9x4v1c8r3t6w0z5b2n8h4j6p1d3",
    "createdAt": "2026-10-01T08:30:00Z",
    "updatedAt": "2026-10-01T08:30:00Z"
  },
  "meta": { "requestId": "01m3c081dbf3j55x7hsa7wc1yj" }
}

Give url to the sender, in the place its settings ask for a webhook or callback URL.

What a source takes

• Any method. POST is usual, and PUT, PATCH, GET, and DELETE are kept the same way. HEAD and OPTIONS get 204 and are not kept.
• Any path after the address. https://hooks.digitospace.com/in/src_…/payments/mpesa reaches the same source, and the event keeps /payments/mpesa as its path, so a filter can use it.
• A body of at most 5 MB. A larger one gets 413.
• Any headers and query. They are kept with the event, so your app gets the sender’s own signature headers unchanged.

What a sender gets back

A sender sees 200 once the webhook is kept, before it is delivered, so a slow or failing destination never makes the sender wait or give up.

Keep the address secret

The address is the source’s secret: anyone who has it can send webhooks to the source. Give it only to the sender, and keep it out of code and public pages.

If the address leaks, reset it. The source gets a new address straight away, and webhooks sent to the old one are no longer kept, so give the new one to the sender:

curl -X POST "$HOOKS_URL/sources/$SOURCE_ID/url" \
  -H "Authorization: Bearer $HOOKS_API_KEY"

In the console, open the source and select Reset URL.

We do not check senders’ own signatures. They reach your app unchanged, with the same body, so your app can still check them itself.

Rename or delete a source

Rename it with PUT, which keeps its address. Deleting a source deletes its connections and every event it received, and cannot be undone. Webhooks sent to its address after that are not kept, even when the sender gets 200.

See Sources for every call.