API Reference

Authentication

Customer API routes use:

Code example

Authorization: Bearer iwk_...

API keys are created in the dashboard, stored as hashes, displayed later by prefix only, track last-used time, and support scoped permissions: events:read, events:replay, deliveries:retry, endpoints:read, and endpoints:write.

Ingest Webhook

Code example

POST /api/ingest/:endpointToken

Accepted requests return:

Code example

{ "ok": true, "event_id": "evt_...", "status": "queued" }

Errors include 401 invalid endpoint token, 403 disabled endpoint, 413 payload too large, 429 rate limited, and 500 storage failure.

Event Object

id: internal event UUID.
event_id: stable evt_ identifier returned by ingest.
status: received, queued, delivered, failed, retry_scheduled, dead_lettered, replayed, or archived.
project_id and endpoint_id: ownership scope.
payload_sha256: hash of the payload body.
payload_size_bytes and content_type: request metadata.
received_at: intake timestamp.

Delivery Attempt Object

id: attempt UUID.
event_id: related event UUID.
destination_id: destination that received the attempt.
attempt_number: one-based attempt count.
status: success, failed, timeout, or error.
response_status: HTTP status when available.
duration_ms: delivery duration.
error_message: normalized failure message when available.
created_at: attempt timestamp.

Events

Code example

GET /api/events
GET /api/events/:eventId
POST /api/events/:eventId/replay
POST /api/events/:eventId/retry

List events accepts projectId, endpointId, status, destinationId, search, payloadHash, responseStatus, receivedFrom, receivedTo, and limit query parameters. Get event accepts either the internal UUID or the evt_ ID returned by ingest and returns event metadata, delivery jobs, delivery attempts, and dead-letter metadata without exposing encrypted payload bodies.

Replay requires events:replay. Retry requires deliveries:retry and moves retryable failed, dead-lettered, retry-scheduled, or cancelled delivery jobs back to pending.

Endpoints

Code example

GET /api/endpoints
POST /api/endpoints/:endpointId/rotate-token

List endpoints requires endpoints:read. Rotate token requires endpoints:write and returns the new ingest token once.

API Keys

Code example

POST /api/api-keys
POST /api/api-keys/:keyId/revoke

Key creation and revocation require a signed-in dashboard session. The create response includes the raw key once, its ID, display prefix, and scopes. Later dashboard views show the prefix, scopes, status, and last-used timestamp only.