API 12 · Runs on Vercel

Webhook Relay

Creates a relay with a private receive URL and a signing secret. Senders must sign requests (timestamped HMAC-SHA256, or GitHub's x-hub-signature-256), so the endpoint cannot act as an open relay. Accepted events are de-duplicated, filtered by event-type patterns, re-signed and forwarded to your public HTTPS destination without following redirects. Failed deliveries retry with exponential backoff (6 attempts), every attempt is logged, and final failures create a notification.

POST https://dev.itsozy.lol/api/v1/webhooks

Runs on Vercel. Runs on Vercel. Retries are driven by /api/v1/internal/tick.

Authentication

Send Authorization: Bearer ozy_… with an API key that includes the webhooks permission (or *). Signed-in dashboard sessions work in the playground. Each call costs 1 unit.

Parameters

Name	Type		Description
`destination`	string	required	Public https URL that receives forwarded events
`event_types`	string[]	optional	Patterns such as "order." or "push" (default [""])

Example request

curl -X POST https://dev.itsozy.lol/api/v1/webhooks \
  -H "Authorization: Bearer $OZY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"destination": "https://hooks.example.com/ozy", "event_types": ["order.*"]}'

Example response (illustrative)

{
  "event_types": [
    "order.*"
  ],
  "id": "3c55…",
  "receive_url": "https://dev.itsozy.lol/api/v1/hooks/3c55…",
  "secret": "whsec_…"
}

Related endpoints

Errors

Errors use one envelope: {"error": {"code": "…", "message": "…"}}.

Status	Code	Meaning
401	`invalid_signature`	Inbound request was unsigned, stale or incorrectly signed
413	`payload_too_large`	Inbound payload exceeded 256 KiB
400	`invalid_input`	A parameter is missing or invalid
401	`unauthorized`	No valid API key or session
403	`permission_denied`	The key does not include this API's permission
429	`quota_exceeded`	Free-tier quota reached (20 units/min, 100 units/day)
503	`database_unavailable`	Persistent storage is temporarily unavailable

Rate limits

20 units per minute and 100 units per day per account; outbound fetches to the same host are spaced at least one second apart. Exceeding a limit returns 429.

Try it in the playground