API Reference
Getting Started
The Hookdeck REST API allows you to set up connections, retrieve events, and perform actions programmatically.
Get an API key
You'll need to include an API key in every API request. If you do not yet have a Hookdeck account, please sign up for a free account. Your API key is located in your project settings.
To include your API key in requests, use either Bearer Token Authentication or Basic Authentication.
| Method | Procedure |
|---|---|
| Bearer Token Authentication | Include the header Authorization: Bearer $API_KEY, replacing $API_KEY with your personal key |
| Basic Authentication | Set the username as your API key, and supply an empty password |
Basic Authentication is deprecated and remains supported for backwards compatibility.
Create your first connection
As an example let's create a connection between a source and a destination. This will allow you to start routing events with Hookdeck.
Minimum parameters
| Parameter | Type | Description |
|---|---|---|
| name | string | Name of the connection to create |
| source.name | string | Name of the source to create |
| destination.name | string | Name of the destination to create |
| destination.config.url | string | HTTP endpoint of the destination |
By default, the source is assumed to be of type
WEBHOOKand the destination of typeHTTP.
View the full specification for the connection object here.
Verify your first connection
Verifying the connection lets you know Hookdeck is properly ingesting and processing events from your source.
Copy the unique Hookdeck URL and paste it into your API provider's HTTP URL field. Test the connection by triggering a request on your source. As soon Hookdeck receives your first request, it'll appear in your dashboard.
Congratulations! Your request & events can now be viewed, inspected, filtered, sorted, retried, and so much more using Hookdeck.
Authentication
Scope: This authentication method applies to Hookdeck REST API endpoints (e.g.,
/events,/requests,/sources) and Hookdeck Publish API endpoints (https://hkdk.events/v1/publish). For authentication when sending requests to a Source URL (e.g.,https://hkdk.events/src_123...), see Source Authentication.
Your API key is located in your project settings, and must be included in every API request. Use either Bearer Token Authentication or Basic Authentication.
| Method | Procedure |
|---|---|
| Bearer Token Authentication | Include the header Authorization: Bearer $API_KEY, replacing $API_KEY with your project key |
| Basic Authentication | Set the username as your API key, and supply an empty password |
Paging
All GET endpoints that retrieve a list of resources are paged using cursor (aka keyset) pagination, which resides in the response body's pagination object.
| Parameter | Default | Description |
|---|---|---|
| order_by | "created_at" | The sortable key to use (options varies base on the resource ) |
| dir | "desc" | The direction to sort it ("asc" or "desc") |
| limit | 100 | The making amount of results returned per query (max: 250) |
| next | undefined | The ID to provide in the query to get the next set of results |
| prev | undefined | The ID to provide in the query to get the previous set of results |
Unless you have specified an order_by or dir, you can omit it from the next or previous set query. You only have to carry them over if you are not using the resource default.
Errors
Hookdeck uses standard HTTP response codes to indicate the success or failure of an API request.
| Parameter | Type | Description |
|---|---|---|
| handled | boolean | Error was handled by the API and did not resolve in an uncaught exception |
| status | integer | HTTP status code for the error |
| message | string | Any message associated with the error |
| data | object | Any data related to the error, useful for diagnostics |
In general, codes in the 2xx range indicate success, codes in the 4xx range indicate an error that resulted from the provided information (e.g. a required parameter was missing), and codes in the 5xx range indicate an error. See a more complete list of error codes here.
Rate Limits
The Hookdeck API has a rate limit of 240 request per minute, per API key. Contact us if you need your rate limit increased.
Query Formatting
Arrays
Arrays in query parameters are indicated by a [] appended to their type, like string[].
For example: ?item[1]=hello&item[2]=world is parsed as ["hello", "world"]
Date
Dates are expected in ISO format.
For example: 2021-01-21T20:16:28Z or 2021-01-21
JSON
Some query parameters take JSON as input. The JSON should be stringified and URL encoded.
For example: ?body=%7B%0A%20%20"hello"%3A%20"world"%0A%7D is parsed as { "hello": "world" }
Operators
Most GET endpoints that retrieve a list of resources support operators as part of the request query.
For example: ?number[gte]=1&number[lte]=10
| Operator | Supported Types | Description |
|---|---|---|
| gte | date number | Greater than or equal to |
| gt | date number | Greater than |
| lte | date number | Lesser than or equal to |
| lt | date number | Lesser than |
| any | date number string | Not null |
| contains | string | Contains |
OpenAPI Schema
Our OpenAPI schema is available at https://api.hookdeck.com/2025-07-01/openapi.
OpenAPI schemas can be used to generate SDKs for your language of choice and work with various tools made for OpenAPI definitions such as importing into Postman.
Changelog
When backwards-incompatible changes are made to the API, a new, dated version is released. The latest version is 2025-07-01.
The API version can be set in the base path of any endpoint, such as https://api.hookdeck.com/2025-07-01/sources. Otherwise the API defaults to the oldest supported version.
The backwards-incompatible changes for each version are listed below. Backwards-compatible changes don’t need a new API version and do not appear in this list.
Dated versions remain officially supported for up to 1 year after the date of release. For instance 2023-07-01 will be officially supported until 2024-07-01.
2025-07-01
Transformation and Filter Order
Transformations and filters are now be ordered via the rules property in a connection. This allows for greater flexibility in how events are processed.
Prior to this change, transformations always ran before filters. Now, you can control the order of execution by placing transformations before or after filters in the rules array.
To preserve existing behavior, ensure that transformation rules are placed before filter rules in the rules array.
The delay and retry rules do not have an order and can be placed anywhere in the rules array.
2025-01-01
Source and Destination Types
Source and Destination Types are now available on the Source and Destination objects. This introduces the following changes:
- Added
typeproperty to the Source and Destination objects, which can be set when creating or updating them. - Added
configproperty to contain all type-dependent configuration options, including authentication methods, custom responses, and HTTP method restrictions. See the source object for more details on each Type configuration.
Source
- The Source
typeproperty defaults toWEBHOOKand has no requiredconfigproperty. - The
custom_response,allowed_http_methodsproperties have been moved to the Source to theconfigobject for the supportedtype. - The
verificationhas been moved to theconfigobject and theverification.typeproperty is nowconfig.auth_typeand theverification.configproperty is justconfig.auth.
Destination
- The Destination
typeproperty defaults toHTTPand requires aconfig.urlproperty. - The Destination properties
url,rate_limit,rate_limit_period,disabled_path_forwardingandhttp_methodhave been moved to theconfigobject for the supportedtype. - The Destination
cli_pathproperty has been renamed topathand has been moved to theconfigobject whentypeisCLI. - When
typeisCLItherate_limitandrate_limit_periodproperties are not supported.
2024-09-01
Change to attempts
Attempts no longer store state and are created when the event is delivered rather then when the event is queued for delivery.
Because of the underlying data structure change, the behavior of the API has changed for some endpoint, regardless of versions. While those are not technically breaking changes, they are worth noting:
- The
/attempts(see: Retrieve all attempts) endpoint now only returns attempts with status ofSUCCESFULorFAILED. This is true regardless of API version. - The
/events/:id/retrywill always returnnullfor theattemptproperty on the response. This is true regardless of API version.
The breaking changes for this version specifically are:
- The
/events/:id/retry(see: Retry an event) endpoint previously returned{ event: Event, attempt: Attempt }and now only returns the Event object in root of the response.
2024-03-01 [DEPRECATED]
Renamed archive to disable
On Source, Destination and Connection objects, archive and unarchive have been renamed as disabled and enable. This affects the following:
archived_athas been renamed todisabled_at/sources/:id/archivehave been renamed to/sources/:id/disable(see Disable a source)/sources/:id/unarchivehave been renamed to/sources/:id/enable(see Enable a source)/connections/:id/archivehave been renamed to/connections/:id/disable(see Disable a connection)/connections/:id/unarchivehave been renamed to/connections/:id/enable(see Enable a connection)/destinations/:id/archivehave been renamed to/destinations/:id/disable(see Disable a destination)/destinations/:id/unarchivehave been renamed to/destinations/:id/enable(see Enable a destination)- Ignored event cause
ARCHIVEDhas been renamed asDISABLED - Rejection cause
SOURCE_ARCHIVEDhas been renamed asSOURCE_DISABLED
Standardise source verification configs
To use consistent casing and keys between source authentication and destination authentication, we have made the following changes:
- On the Source's verification, rename
userasusernamein the following config types:- Basic Auth
- Postmark
- Pipedrive
- All config types have been uppercased on the Source's verification. For instance,
hmacis renamed asHMAC,githubis renamed asGITHUBand so on
2023-07-01 [DEPRECATED]
Removing rulesets
Removes support for Rulesets and is replaced by setting rules directly on connections.
- Removed
rulesetsobject andresolved_rulesarray from Connections. - Removed all
/rulesetsendpoints - Removed
rulesetandruleset_idproperty when creating or updating a Connection
Replacing integrations by Source "verification"
Connections
A connection lets you route events from a source to a destination.
Connections were historically called "webhooks". The endpoint root path
/webhookshas been moved to/connections. The former will remain functional, but consider migrating to/connections. Because of this quirk, connections ids start withweb_instead ofcon_. References to connection ids are shown aswebhook_idinstead ofconnection_id.
Connection object
id
stringID of the connection
name
stringUnique name of the connection for this source
full_name
stringFull name of the connection concatenated from source, connection and desitnation name
description
stringDescription of the connection
team_id
stringID of the project
destination
DestinationAssociated Destination object
source
SourceAssociated Source object
rules
Rule[]Array of rules configured on the connection
disabled_at
stringDate the connection was disabled
paused_at
stringDate the connection was paused
updated_at
stringDate the connection was last updated
created_at
stringDate the connection was created
Retrieve all connections
This endpoint lists all connections, or a subset of connections.
Query Parameters
id
stringstring[]Filter by connection IDs
name
stringOperatorsstring[]Filter by connection name
destination_id
stringstring[]Filter by associated destination IDs
source_id
stringstring[]Filter by associated source IDs
disabled
booleanInclude disabled resources in the response
disabled_at
stringOperatorsDate the connection was disabled
full_name
stringFuzzy match the concatenated source and connection name. The source name and connection name must be separated by " -> "
paused_at
stringOperatorsDate the connection was paused
order_by
stringstring[]Sort key(s)
dir
stringstring[]Sort direction(s)
limit
integerResult set size
next
stringThe ID to provide in the query to get the next set of results
prev
stringThe ID to provide in the query to get the previous set of results
Retrieve a connection
This endpoint retrieves a specific connection.
URL Parameters
id
stringConnection ID
Create a connection
This endpoint creates a connection.
Body Parameters
name
stringA unique name of the connection for the source
description
stringDescription for the connection
destination_id
stringID of a destination to bind to the connection
source_id
stringID of a source to bind to the connection
destination
objectDestination input object
source
objectSource input object
rules
Rule[]Create a connection with new resources
You can create a connection's underlying source, destination, and rules with a single call by declaring an object for any of those resources.
{
"name": "github-some-api",
"source": {
"name": "github"
},
"rules": [
{
"type": "retry",
"count": 20,
"interval": 300,
"strategy": "exponential"
},
{
"type": "deduplicate",
"window": 300000,
}
],
"destination": {
"name": "some-api",
"config": {
"url": "https://example.com/webhook"
}
}
}
Create a connection with existing resources
You can reuse a source or destination by referencing their ID.
{
"source_id": "src_xxx",
"destination_id": "des_xxx"
}
Create/Update a connection
This endpoint creates a connection.
This endpoint creates a connection, or updates an existing connection by name.
A connection's source and destination cannot be updated.
Body Parameters
name
stringA unique name of the connection for the source
description
stringDescription for the connection
destination_id
stringID of a destination to bind to the connection
source_id
stringID of a source to bind to the connection
destination
objectDestination input object
source
objectSource input object
rules
Rule[]Update a connection
This endpoint updates a connection.
URL Parameters
id
stringConnection ID
Body Parameters
name
stringdescription
stringDescription for the connection
rules
Rule[]Pause a connection
This endpoint pauses a connection.
A paused connection will still receive events, but those events will be marked with a status of HOLD and will be delivered only once the connection is unpaused.
URL Parameters
id
stringConnection ID
The parameter
paused_atis set to the current timestamp.
Unpause a connection
This endpoint unpauses a connection.
Any event with a status of HOLD will be attempted (destination delivery rate will be respected). This operation is asynchronous, so it may take some time for all events to be QUEUED for delivery.