Registry API
Webhooks
Subscribe URLs to audit events and inspect deliveries.
Deliveries are HMAC-SHA256 signed (X-Workloom-Signature) and retried five times with backoff from 1 minute to 6 hours before they go dead.
Operations
| Request | What it does |
|---|---|
| POST /api/webhooks | Create a webhook |
| GET /api/webhooks | List webhooks |
| GET /api/webhooks/{id} | Get a webhook |
| PATCH /api/webhooks/{id} | Update a webhook |
| DELETE /api/webhooks/{id} | Delete a webhook |
| POST /api/webhooks/{id}/test | Send a test delivery |
| GET /api/webhooks/{id}/deliveries | List a webhook’s deliveries |
Operations are exactly those in the committed OpenAPI document (packages/workloom-api/openapi.json), which matches the route definitions; this site checks its list against both. Paths are under the API host. Public, approved packages and profiles can be read without a token; everything else needs one.