Create a webhook endpoint
Returns the signing `secret` ONCE — store it before you close the response. The URL must be https and must resolve to a public address; private and link-local targets are rejected at save time. Default payload is core fields only; opt into PHI-bearing content blocks explicitly via `payloadConfig`. Limit: 20 endpoints per workspace. Required scope: `webhooks.manage`.
/webhook-endpointsAuthorization
ApiKeyAuth An external API key, sent as Authorization: Bearer mflo_…. Scopes are checked per route; see each operation’s description.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/webhook-endpoints" \ -H "Content-Type: application/json" \ -d '{ "url": "string", "subscribedEvents": [ "*" ] }'{ "data": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "url": "string", "description": "string", "subscribedEvents": [ "string" ], "payloadConfig": null, "status": "ENABLED", "consecutiveFailures": 0, "lastSuccessAt": "string", "lastFailureAt": "string", "autoDisabledAt": "string", "previousSecretExpiresAt": "string", "createdAt": "string", "updatedAt": "string", "secret": "string" }}Send a test event POST
Sends a real event through the full delivery pipeline (signature, SSRF vetting, 10 s timeout), so a green result means your endpoint will actually work. The body is optional — omit it for a plain `ping`, or name any catalogued `eventType` to receive that type’s SAMPLE payload (the same object `GET /meta/event-types` publishes as `sampleEnvelope`). Every delivery from this route carries a `Mediflo-Event-Test: true` request header, which real events never do — branch on it to drop test traffic. Repeated sends of the SAME type within one minute collapse onto a single event (each still gets its own delivery row); different types never collapse. Asynchronous: poll the returned `deliveryId` in the delivery log. The endpoint must be `ENABLED`. Required scope: `webhooks.manage`.
Soft-delete a workflow DELETE
Deleting the ACTIVE workflow is allowed: it is deactivated and soft-deleted in one step, returning the bot to prompt-only mode. The workflow disappears from every list and cannot be reactivated. Required scope: `bots.write`.