Create a webhook endpoint
Registers an HTTPS destination for the events you select. The signing secret is
returned once: every delivery carries a Carhub-Signature HMAC computed with it.
Failed deliveries are retried with exponential backoff for 24 h.
Minimum role: admin.
Authorizations
Short-lived JWT issued by the CarHub auth service (Better Auth), verified against its
JWKS. Claims: sub (user), org_id (active organisation) and role
(owner | admin | member). Used by the dashboard for /mgmt/v1/… only — it is never
accepted on /v1/….
Headers
Client-generated key (a UUID is ideal) making this POST safe to retry. The first request
is executed and its response stored for 24 h; any replay with the same key returns that
stored response with Idempotent-Replayed: true and bills nothing. Reusing a key with a
different payload is a 409 idempotency_key_reuse.
8 - 255Body
HTTPS only, and must resolve to a public address — private ranges and link-local addresses are refused. Must answer 2xx within 10 seconds.
1An event your endpoint can subscribe to.
job.succeeded, job.failed, inspection.stage_completed 255Response
Endpoint created. Store secret now.
"whe_5DfG8hJk"
"webhook_endpoint""https://api.garage-dupont.fr/hooks/carhub"
Event types this endpoint is subscribed to.
1An event your endpoint can subscribe to.
job.succeeded, job.failed, inspection.stage_completed Automatically moved to disabled after 24 h of consecutive delivery failures; re-enable it from the dashboard.
enabled, disabled An endpoint receives events of its own mode only.
Epoch seconds, UTC.
1755300000
Deliveries that have failed in a row. Reset to 0 by the next success.
x >= 0Epoch seconds, UTC.
1755300000
Transport error or status of the most recent failure.
"502 Bad Gateway"
HMAC signing secret, shown once. Every delivery to this endpoint is signed with it in Carhub-Signature.
"whsec_9Kd8xQmPvL4TnW2sYbRc"