Skip to main content
POST
Create a webhook endpoint
The response includes the signing secret (a whsec_... value) once. Store it right away; later reads show a masked version. If you lose it, delete the endpoint and create a new one. Deliveries are signed with HMAC-SHA256 — see Events & signatures for the payload and how to verify them.

Authorizations

Authorization
string
header
required

Use an Orbit API key from the developer dashboard.

Body

application/json
url
string<uri>
required

A publicly reachable https:// URL. Slack incoming-webhook URLs are accepted and receive a formatted message instead of the raw JSON payload.

event_types
enum<string>[]

Events to deliver. Omit to subscribe to all supported events.

Available options:
profile.updated,
company.thesis.changed,
company.alert,
portfolio.changed
description
string

Free-form label for your own bookkeeping.

Response

The endpoint, with its signing secret.

id
string<uuid>
required
url
string<uri>
required

The endpoint URL. Secret-bearing URLs (for example Slack incoming webhooks) are shown redacted.

event_types
enum<string>[]
required
Available options:
profile.updated,
company.thesis.changed,
company.alert,
portfolio.changed
enabled
boolean
required
created_at
string<date-time>
required
secret
string
required

The signing secret (whsec_...). Shown once, at creation. Store it right away.

supported_event_types
enum<string>[]
required
Available options:
profile.updated,
company.thesis.changed,
company.alert,
portfolio.changed
description
string | null
secret_prefix
string

First characters of the signing secret, for identification.

secret_suffix
string
last_delivery_at
string<date-time> | null