Get an endpoint's signing secret
Returns the signing secret for one endpoint URL in this project, creating it on first use. Call it when you set up your receiver; the same URL always gets the same secret until you rotate it. URLs are compared after lowercasing the scheme and host and removing a default port.
POST
/v1/webhooks/secret
Returns the signing secret for one endpoint URL in this project, creating it on first use. Call it when you
set up your receiver; the same URL always gets the same secret until you rotate it. URLs are compared after
lowercasing the scheme and host and removing a default port.
Authentication
Bearer Token (b3os_sk_ API key or b3os_pat_ token) API Key (cookie: __Host-b3os_session)
Request Body required
application/jsonurl
string (uri)
REQUIRED
Responses
200
The secret.
application/jsonobject
string
REQUIRED
Enum:
webhook_secreturl
string (uri)
REQUIRED
The normalized endpoint URL.
secret
string
REQUIRED
previous_valid_until
string (date-time) | null
REQUIRED
Until when the previous secret still signs deliveries, after a rotation.
created_at
string (date-time)
REQUIRED
400
The request failed validation (`invalid_request`, `invalid_url`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
401
Missing, malformed, expired or revoked credentials (`unauthorized`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
403
Authenticated but not allowed (`forbidden`, `egress_denied`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
413
The request body exceeds this operation's limit.
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
415
The Content-Type is not accepted by this operation.
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
422
The URL is not https, too long, or refused by the egress guard (`invalid_webhook_url`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
429
A rate, concurrency or quota limit applies (`rate_limited`, `concurrency_limited`, `quota_exceeded`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
500
Something failed inside B3OS (`internal`). Retry with backoff.
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
503
The node or the product is not available right now (`node_unavailable`, `product_unavailable`, `capacity_unavailable`).
application/problem+jsontype
string (uri)
REQUIRED
`https://docs.beta.b3os.org/errors#<code>`.
title
string
REQUIRED
Short summary of the problem type.
status
integer
REQUIRED
The HTTP status code, repeated for convenience.
code
string
REQUIRED
Stable machine-readable error code from the errors catalog.
detail
string
REQUIRED
Explanation of this occurrence. Never contains secrets.
instance
string
The request ID (`req_…`) of the request that failed. Include it when you contact support.
errors
object[]
Validation problems, one per field (`invalid_request` and the other codes that list `errors`).
Array of:
pointer
string
REQUIRED
Where the problem is: a JSON pointer into the request body (`/url`, `/steps/0/uses`), or `#query/<name>`,
`#path/<name>` or `#header/<name>` for parameters.
detail
string
REQUIRED
What is wrong there.
reason
string
Finer-grained cause for codes that document one (`unauthorized`, `forbidden`, `egress_denied`, `upstream_unreachable`, …).
required_scope
string
The scope that was missing (`forbidden` with `reason: scope`).
retry_after_s
integer
Same value as the `Retry-After` header, for clients that only read the body.
limit
object
The limit an error refers to. IDs and current values are listed by `GET /v1/limits`.
id
string
REQUIRED
Limit ID, such as `vision.scrape.rpm` or `sandboxes.concurrent`.
limit
number
REQUIRED
The limit's value.
unit
string
REQUIRED
What the limit counts, such as `requests`, `sandboxes`, `vcpu` or `MiB`.
window_s
integer
Window length in seconds for rate limits and quotas.
current
number
Current usage against the limit, when known.
current_status
string
The object's current status, for state conflicts such as `sandbox_not_running`.
upstream_status
integer
The HTTP status the upstream returned (`upstream_error`, `action_output_invalid`).
step
string
The failed step, as a step ID (routines), an index (`act`) or a path such as `beats/2/do/0` (render).
pack_error
object
The error a pack's error mapping chose (`upstream_error` from pack actions).
code
string
REQUIRED
message
string
REQUIRED
retryable
boolean
REQUIRED
curl -X POST 'https://beta-api.b3os.org/v1/webhooks/secret' \ -H 'Authorization: Bearer YOUR_API_TOKEN' \ -H 'Content-Type: application/json' \ -d '{ "url": "https://example.com/hooks/b3os"}'const response = await fetch('https://beta-api.b3os.org/v1/webhooks/secret', { method: 'POST', headers: { "Authorization": "Bearer YOUR_API_TOKEN", "Content-Type": "application/json" }, body: JSON.stringify({ "url": "https://example.com/hooks/b3os" })});const data = await response.json();console.log(data);import requestsheaders = { 'Authorization': 'Bearer YOUR_API_TOKEN'}response = requests.post('https://beta-api.b3os.org/v1/webhooks/secret', headers=headers, json={ "url": "https://example.com/hooks/b3os"})print(response.json())
200
Response
{ "object": "webhook_secret", "url": "https://example.com/hooks/b3os", "secret": "whsec_ex4mple7ex4mple7ex4mple7ex4mple7", "previous_valid_until": null, "created_at": "2026-10-25T20:20:00.000Z"}
400
Response
{ "type": "https://docs.beta.b3os.org/errors#invalid_request", "title": "Invalid request", "status": 400, "code": "invalid_request", "detail": "1 field failed validation", "instance": "req_01m5t4yg394wegr3j4y01qb363", "errors": [ { "pointer": "/url", "detail": "must be an absolute http or https URL" } ]}
401
Response
{ "type": "https://docs.beta.b3os.org/errors#unauthorized", "title": "Unauthorized", "status": 401, "code": "unauthorized", "detail": "API key checksum does not match; check that the whole key was copied", "instance": "req_01m5t4yg394wegr3j4y01qb363", "reason": "malformed"}
403
Response
{ "type": "https://docs.beta.b3os.org/errors#forbidden", "title": "Forbidden", "status": 403, "code": "forbidden", "detail": "This key lacks the scope sandboxes:write", "instance": "req_01m5t4yg394wegr3j4y01qb363", "reason": "scope", "required_scope": "sandboxes:write"}
413
Response
{ "type": "https://docs.beta.b3os.org/errors#payload_too_large", "title": "Payload too large", "status": 413, "code": "payload_too_large", "detail": "Request body is 1572864 bytes; this operation accepts at most 1048576", "instance": "req_01m5t4yg394wegr3j4y01qb363"}
415
Response
{ "type": "https://docs.beta.b3os.org/errors#unsupported_media_type", "title": "Unsupported media type", "status": 415, "code": "unsupported_media_type", "detail": "Expected Content-Type application/json", "instance": "req_01m5t4yg394wegr3j4y01qb363"}
422
Response
{ "type": "https://docs.beta.b3os.org/errors#invalid_webhook_url", "title": "Invalid webhook URL", "status": 422, "code": "invalid_webhook_url", "detail": "http://example.com/hook is not https", "instance": "req_01m5t4yg394wegr3j4y01qb363", "errors": [ { "pointer": "/url", "detail": "must use https" } ]}
429
Response
{ "type": "https://docs.beta.b3os.org/errors#rate_limited", "title": "Rate limited", "status": 429, "code": "rate_limited", "detail": "60 scrapes per minute allowed; retry in 12 seconds", "instance": "req_01m5t4yg394wegr3j4y01qb363", "retry_after_s": 12, "limit": { "id": "vision.scrape.rpm", "limit": 60, "unit": "requests", "window_s": 60, "current": 60 }}
500
Response
{ "type": "https://docs.beta.b3os.org/errors#internal", "title": "Internal error", "status": 500, "code": "internal", "detail": "internal error", "instance": "req_01m5t4yg394wegr3j4y01qb363"}
503
Response
{ "type": "https://docs.beta.b3os.org/errors#node_unavailable", "title": "Node unavailable", "status": 503, "code": "node_unavailable", "detail": "Node n1 is not reachable; retry in 5 seconds", "instance": "req_01m5t4yg394wegr3j4y01qb363", "retry_after_s": 5}API Playground
Try this endpoint
POST
/v1/webhooks/secret
Response
Response Headers
Request History
Was this page helpful?