Webhooks

Base URL https://api.flam.fashion. Send Authorization: Bearer flam_sk_… on every call; a handful of routes are session-only and say so. How keys and roles work.

GET /api/toolkit/webhooks

List the house's endpoints

Never returns secret — it exists only in the create response. Owner or admin only.

Responses

200 returns:

{
  "endpoints": [
    {
      "id": "string",
      "url": "string",
      "events": [
        "string"
      ],
      "active": true,
      "createdAt": "string"
    }
  ]
}

Call it

curl -X GET "https://api.flam.fashion/api/toolkit/webhooks" \
  -H "Authorization: Bearer $FLAM_API_KEY"

POST /api/toolkit/webhooks

Register an endpoint FLAM should call

Returns secret ONCE — it is the HMAC key for every delivery to this endpoint and is never returned again. Deliveries are signed to the standard-webhooks spec (webhook-id, webhook-timestamp, webhook-signature: v1,<base64>), so any standard-webhooks client verifies them unchanged. Owner or admin only.

The URL must be https:// and must not name a private address. Refused: loopback (127.0.0.0/8, ::1, 0.0.0.0), RFC1918 (10/8, 172.16/12, 192.168/16), link-local (169.254.0.0/16 — cloud metadata — and fe80::/10), IPv6 unique-local (fc00::/7), IPv4-mapped forms of any of those, hostnames ending .internal/.local/.svc, and single-label hostnames. The same check runs again at delivery time, so re-pointing the name after registration does not get past it, and redirects are never followed.

Request body — application/json

{
  "url": "https://…",
  "events": [
    "develop.done"
  ]
}

Responses

201 returns:

{
  "id": "string",
  "url": "string",
  "events": [
    "string"
  ],
  "active": true,
  "createdAt": "string",
  "secret": "string"
}

Call it

curl -X POST "https://api.flam.fashion/api/toolkit/webhooks" \
  -H "Authorization: Bearer $FLAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://…","events":["develop.done"]}'

DELETE /api/toolkit/webhooks/{id}

Remove an endpoint

Deletes the endpoint AND drains its queued deliveries (ON DELETE CASCADE) — nothing is left to POST to a URL you just removed. Org-scoped in the WHERE, so one house can never remove another's endpoint; an id that is not yours is a 404, not a 403. Owner or admin only.

Parameters

Responses

200 returns:

{
  "deleted": true,
  "id": "string"
}

Call it

curl -X DELETE "https://api.flam.fashion/api/toolkit/webhooks/{id}" \
  -H "Authorization: Bearer $FLAM_API_KEY"