---
title: Webhooks
description: Subscriptions that POST a JSON payload to your URL when records change, for the events you choose.
canonical: https://developers.coevera.com/reference/rest/webhooks/
section: rest
verification: schema
generatedFrom: spec 5e43371 (2026-10-16)
publisher: Coevera
---

# Webhooks

Subscriptions that POST a JSON payload to your URL when records change, for the events you choose.

Each webhook has a target `url` and a list of `events`, such as Account.Update. Set `signature` to have every delivery signed with HMAC-SHA256 in the WebHook-Signature header. A delivery times out after 10 seconds and is retried with backoff.

Family: Webhooks and automation. GraphQL: [webhook](https://developers.coevera.com/reference/graphql/webhook.md). Base URL: `https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}`.

| Method | Path | Operation |
| --- | --- | --- |
| GET | `/entities/Webhooks` | List webhooks |
| POST | `/entities/Webhooks` | Create a webhook |
| GET | `/entities/Webhooks/{id}` | Get a webhook |
| PATCH | `/entities/Webhooks/{id}` | Update a webhook |
| DELETE | `/entities/Webhooks/{id}` | Delete a webhook |
| POST | `/entities/Webhooks/batch-modify` | Create or update webhooks in a batch |
| POST | `/entities/Webhooks/batch-delete` | Delete webhooks in a batch |
| POST | `/entities/Webhooks/batch-restore` | Restore deleted webhooks |

## List webhooks

`GET /entities/Webhooks`

Returns the webhooks of the space, one page at a time.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `include-deleted` | query | boolean | Include soft-deleted records. Lists only; get-by-id refuses it. |
| `first` | query | integer | Page size. Default 30, maximum 100; a larger value is refused with HTTP 400, code 117. (default 30, 1 to 100) |
| `last` | query | integer | Return the last N records of the result; together with `first`, the last N of the first M. Maximum 100. (1 to 100) |
| `before` | query | string | Cursor from `page_info.start_cursor`, to page backwards. URL-encode it. |
| `after` | query | string | Cursor from `page_info.end_cursor` of the previous page. URL-encode it: cursors are base64, and a raw + becomes a space. |
| `expand` | query | string | Related records to return inline instead of their URIs, comma-separated; dots reach nested relations, as in `account_relations.account`. |
| `order-by` | query | string | Fields to sort by, comma-separated. A leading - sorts descending, as in `-modified`; dotted paths sort by related fields. |
| `filter` | query | object | `filter[field]=value`. Separate several values with a raw comma (OR), as in `filter[name]=north,south`. Encode a comma that belongs to a value as %2C. URLSearchParams and Python requests encode every comma, so build the filter part of the query string yourself. Dotted paths filter on related records, as in `filter[owner.email]`. Encode a + in a value as %2B: query values are form-decoded, so a raw + becomes a space. |
| `filter-op` | query | object | `filter-op[field]=operator`, one per field: eq (the default), ieq, not-eq, not-ieq, contains, icontains, starts, istarts, ends, iends, gt, gte, lt, lte, between, null, not-null, empty and not-empty. null, not-null, empty and not-empty take no filter value; gt, gte, lt and lte take exactly one. |
| `load-only` | query | string | Fields to return, comma-separated (raw or encoded commas both work here); dots select nested fields, as in `owner.id`. All fields are returned without it. Lists only: get-by-id refuses it with HTTP 400, code 118. |

Responses: 200 (Page of Webhook records.: `success`, `total`, `page_info`, `data`), 400, 401, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks?first=10' \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET"
```

## Create a webhook

`POST /entities/Webhooks`

Subscribes a URL to events and answers 201 with the webhook. `url`, `events` and `insecure_ssl` are required. Set `signature` to have deliveries signed.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `validation-level` | query | integer | Bit mask that relaxes validation on this write. 0 (the default) validates everything. Bits: 2 skip unchanged fields, 4 skip admin-defined validations, 8 allow read-only fields, 16 skip relation checks, 32 skip value checks, 64 skip invalid recalculations, 128 skip step-checklist gates, 256 add conditional field requirements, 512 skip uniqueness checks. Add bits together (20 = 4 + 16); member names and comma lists such as 4,16 work too. A value with an internal-only bit is refused with HTTP 400, code 117. |

Request body: The new record's fields. Relations are set by id. Schema `createWebhookInput`. Required: `insecure_ssl`, `url`, `events`.

Responses: 201 (The created Webhook record.: `success`, `data`), 400, 401, 422, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks' \
  --request POST \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET" \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://hooks.example.com/coevera",
  "events": [
    "Account.Create",
    "Account.Update"
  ],
  "insecure_ssl": false,
  "signature": "5f0c2a8e-3b1d-4c7e-9a46-1d2e3f4a5b6c"
}'
```

## Get a webhook

`GET /entities/Webhooks/{id}`

Returns one webhook by id.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `id` | path | string (uuid) | Required. Id of the Webhook record to retrieve. |
| `expand` | query | string | Related records to return inline instead of their URIs, comma-separated; dots reach nested relations. The only parameter this call accepts. |

Responses: 200 (The Webhook record.: `success`, `data`), 400, 401, 404, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks/ef000000-0000-4000-a000-000000000001' \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET"
```

## Update a webhook

`PATCH /entities/Webhooks/{id}`

Changes the fields you send, such as `events` or `url`, and leaves the rest as they are.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `id` | path | string (uuid) | Required. Id of the Webhook record to update. |
| `validation-level` | query | integer | Bit mask that relaxes validation on this write. 0 (the default) validates everything. Bits: 2 skip unchanged fields, 4 skip admin-defined validations, 8 allow read-only fields, 16 skip relation checks, 32 skip value checks, 64 skip invalid recalculations, 128 skip step-checklist gates, 256 add conditional field requirements, 512 skip uniqueness checks. Add bits together (20 = 4 + 16); member names and comma lists such as 4,16 work too. A value with an internal-only bit is refused with HTTP 400, code 117. |

Request body: The fields to change. Schema `updateWebhookInput`.

Responses: 200 (The changed Webhook record.: `success`, `data`), 400, 401, 404, 422, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks/ef000000-0000-4000-a000-000000000001' \
  --request PATCH \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET" \
  --header 'Content-Type: application/json' \
  --data '{
  "insecure_ssl": false
}'
```

## Delete a webhook

`DELETE /entities/Webhooks/{id}`

Removes the subscription and answers with its id. The API then sends a DELETE request to the webhook's URL.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `id` | path | string (uuid) | Required. Id of the Webhook record to delete. |

Responses: 200 (Deletion confirmation.: `success`, `data`), 400, 401, 404, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks/ef000000-0000-4000-a000-000000000001' \
  --request DELETE \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET"
```

## Create or update webhooks in a batch

`POST /entities/Webhooks/batch-modify`

An item with an `id` updates that webhook; an item without one creates a webhook.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `validation-level` | query | integer | Bit mask that relaxes validation on this write. 0 (the default) validates everything. Bits: 2 skip unchanged fields, 4 skip admin-defined validations, 8 allow read-only fields, 16 skip relation checks, 32 skip value checks, 64 skip invalid recalculations, 128 skip step-checklist gates, 256 add conditional field requirements, 512 skip uniqueness checks. Add bits together (20 = 4 + 16); member names and comma lists such as 4,16 work too. A value with an internal-only bit is refused with HTTP 400, code 117. |
| `rollback-method` | query | integer | 0, the default: one failed item fails the whole batch (HTTP 422, or 404 for an unknown id) and nothing is written. 1: the valid items are written and the call answers 200 with success false and one result per item, an id or an error, in input order. Check every item. (default 0) |

Request body: A JSON array of records: an item with an `id` updates, an item without one creates. Schema `batchWebhookInput`. Required: `insecure_ssl`, `url`, `events`.

Responses: 200 (Result per item, in request order: the id of the created or updated record, or the error.: `success`, `data`), 400, 401, 422, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks/batch-modify' \
  --request POST \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET" \
  --header 'Content-Type: application/json' \
  --data '[
  {
    "insecure_ssl": false,
    "url": "https://hooks.example.com/coevera",
    "events": [
      "Account.*"
    ]
  },
  {
    "id": "ef000000-0000-4000-a000-000000000001",
    "insecure_ssl": false
  }
]'
```

## Delete webhooks in a batch

`POST /entities/Webhooks/batch-delete`

Removes the webhooks whose ids are in the body, a JSON array.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `rollback-method` | query | integer | 0, the default: one failed item fails the whole batch (HTTP 422, or 404 for an unknown id) and nothing is written. 1: the valid items are written and the call answers 200 with success false and one result per item, an id or an error, in input order. Check every item. (default 0) |

Request body: A JSON array of ids.

Responses: 200 (Result per id, in request order: the id of the deleted record, or the error.: `success`, `data`), 400, 401, 404, 422, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks/batch-delete' \
  --request POST \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET" \
  --header 'Content-Type: application/json' \
  --data '[
  "ef000000-0000-4000-a000-000000000001",
  "ef000000-0000-4000-a000-000000000002"
]'
```

## Restore deleted webhooks

`POST /entities/Webhooks/batch-restore`

Restores the deleted webhooks whose ids are in the body, a JSON array.

| Parameter | In | Type | Description |
| --- | --- | --- | --- |
| `rollback-method` | query | integer | 0, the default: one failed item fails the whole batch (HTTP 422, or 404 for an unknown id) and nothing is written. 1: the valid items are written and the call answers 200 with success false and one result per item, an id or an error, in input order. Check every item. (default 0) |

Request body: A JSON array of ids.

Responses: 200 (Result per id, in request order: the id of the restored record, or the error.: `success`, `data`), 400, 401, 404, 422, 429, 500.

```bash
curl 'https://{region}.api.coevera.com/api/v100/rest/spaces/{space_id}/entities/Webhooks/batch-restore' \
  --request POST \
  --user "$COEVERA_API_KEY:$COEVERA_API_SECRET" \
  --header 'Content-Type: application/json' \
  --data '[
  "ef000000-0000-4000-a000-000000000001",
  "ef000000-0000-4000-a000-000000000002"
]'
```

## Webhook fields

| Field | Type | Notes |
| --- | --- | --- |
| `id` | uuid | Read-only. Unique identifier of entity. |
| `insecure_ssl` | boolean | Required on create. If True, remote side ssl certificate will not be validated when delivering notifications. |
| `url` | string | Required on create. Target URL that webhook event payloads are POSTed to. |
| `events` | array of string | Required on create. Event types this webhook subscribes to (e.g. |
| `options` | object | Params in REST API format (snake case), to modify the content of the WebHook. |
| `signature` | uuid | Signature to verify webhook (has to be UUID). |
| `is_delete_protected` | boolean | Read-only. True when the record is protected against deletion because it must always exist in the space. |
| `is_deleted` | boolean | Read-only. Specifies if the entity is considered deleted. |
| `modified` | date-time | Read-only. Last modification time. |
| `created` | date-time | Read-only. Creation time. |
| `application` | uri | Read-only. OAuth application that registered this webhook. |
| `client` | uri → Clients | Read-only. Client who defined the Webhook. |
| `application_id` | uuid | Read-only. Id of the OAuth application that registered the Webhook. |
| `client_id` | uuid → Clients | Read-only. Id of the user who defined the Webhook. |

Custom fields appear in your space's live spec: `GET /api/v100/rest/spaces/{space_id}/openapi.json` with your credentials.

## Errors

Every error body has `success: false`, `http_status`, `code`, `name` and `message`. Branch on `code`: the status alone does not tell a missing permission from a bad parameter.

| HTTP | When |
| --- | --- |
| 400 | Bad request: a bad or unknown parameter (codes 117, 118), a missing permission (code 50), conflicting data (code 2002) or any other API error. The REST API answers 400 where others answer 403 or 409; check `code`. |
| 401 | Not authenticated: missing or wrong credentials, a credential of another space, or an expired token (code 401, ERROR_UNAUTHORIZED). |
| 404 | No such record or entity (code 143 ERROR_NO_ENTITY, or 2006 ERROR_UNKNOWN_TYPE). |
| 422 | Validation failed (code 40000, with the failing fields) or a required parameter is missing (code 119). By default one failed item fails a whole batch and nothing is written. |
| 429 | Too many requests (code 182). Wait for the seconds in Retry-After, then retry. |
| 500 | Unexpected server error (code 1000, ERROR_UNKNOWN). |

All error codes: https://developers.coevera.com/reference/errors.md; how to handle them: https://developers.coevera.com/concepts/errors.md