Create a pull endpoint

POST

/v1/pull-endpoints

curl --request POST \
  --url https://api.hookbridge.io/v1/pull-endpoints \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "Stripe Order Events", "description": "example", "retention_days": 30, "event_type_source": "body", "event_type_path": "type", "verify_static_token": false, "token_header_name": "example", "token_query_param": "example", "token_value": "example", "verify_hmac": false, "hmac_header_name": "example", "hmac_secret": "example", "timestamp_header_name": "example", "timestamp_ttl_seconds": 1, "verify_ip_allowlist": false, "allowed_cidrs": [ "example" ], "idempotency_header_names": [ "example" ], "ingest_response_code": 202 }'

• Production

Creates a new pull mode endpoint. Pull endpoints receive webhooks from external providers and store events for consumer-controlled retrieval via the API, instead of forwarding them.

Authorizations

• BearerAuth

Request Body^required

Media typeapplication/json

object

name

Human-readable name

string

<= 255 characters

Example

Stripe Order Events

description

Description of this endpoint’s purpose

string

<= 500 characters

retention_days

Per-endpoint retention override (default is plan default)

integer

>= 1

Example

30

event_type_source

Where to extract the event type from incoming webhooks

string

Allowed values: body header

event_type_path

JSON path for body extraction (e.g., “type”) or header name (e.g., “X-GitHub-Event”)

string

<= 256 characters

Example

type

verify_static_token

boolean

token_header_name

string

token_query_param

string

token_value

string

>= 16 characters

verify_hmac

boolean

hmac_header_name

string

hmac_secret

string

timestamp_header_name

string

timestamp_ttl_seconds

integer

verify_ip_allowlist

boolean

allowed_cidrs

Array<string>

idempotency_header_names

Array<string>

ingest_response_code

integer

default: 202 >= 200 <= 299

Responses

201

Pull endpoint created

Media typeapplication/json

object

data

object

id

required

string format: uuid

name

string

description

string

mode

required

string

Allowed values: pull

ingest_url

required

URL to give to your webhook provider. Does not include the secret token suffix.

string format: uri

active

required

Whether the endpoint is active (not deleted).

boolean

paused

required

boolean

retention_days

integer

nullable

event_type_source

string

Allowed values: body header

event_type_path

string

counts

Event counts (only on single-endpoint GET, not list)

object

stored

integer

fetched

integer

delivered

integer

total

integer

verify_static_token

boolean

token_header_name

string

token_query_param

string

verify_hmac

boolean

hmac_header_name

string

timestamp_header_name

string

timestamp_ttl_seconds

integer

nullable

verify_ip_allowlist

boolean

allowed_cidrs

Array<string>

ingest_response_code

integer

idempotency_header_names

Array<string>

created_at

required

string format: date-time

updated_at

required

string format: date-time

secret_token

Secret token for the ingestion URL. Shown only once at creation time.

string

ingest_url

required

Full ingestion URL including the secret token suffix.

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "data": {
    "mode": "pull",
    "event_type_source": "body"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

400

Invalid request

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Examples

Endpoint not found

{
  "error": {
    "code": "ENDPOINT_NOT_FOUND",
    "message": "endpoint not found"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid endpoint ID format

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "endpoint_id must be in format ep_xxx"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid payload

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "payload must be valid JSON"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid headers

{
  "error": {
    "code": "INVALID_HEADERS",
    "message": "header 'Host' is forbidden and cannot be overridden"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

401

Unauthorized - Invalid or missing API key

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}