Skip to main content
POST
Subscribe a public HTTPS receiver to workflow metadata
Register an Ultiwrite webhook receiver you control using an approved dashboard key with read and evidence permissions. The endpoint below uses the canonical Ultiwrite OpenAPI contract. The configured service permits at most ten active destinations for your account. Send JSON url and events with the required Idempotency-Key. A new registration returns its signing secret once. An identical retry returns the same endpoint without redisclosing that secret; a different URL or event selection under the same key conflicts. Destinations are immutable and redirects are not followed. Verify the exact raw-body HMAC and handle repeated events. Notification registration does not advance a case or spend analysis credits.

Authorizations

Authorization
string
header
required

Create a key at /settings/api after an administrator approves your account. The key is shown once, can be revoked, and shares the account request allowance with other keys and partner OAuth grants. Send only in Authorization. These keys are not accepted by MCP or the legacy provisioned routes.

Headers

Idempotency-Key
string
required

Stable 8–100 character request key. Reuse only with exactly the same URL/events.

Pattern: ^[A-Za-z0-9_-]{8,100}$

Body

application/json

Public HTTPS destination without query, credentials, fragment, literal IP or custom port; distinct event names.

url
string<uri>
required
Maximum string length: 500
events
enum<string>[]
required
Required array length: 1 - 6 elements
Available options:
analysis.created,
evidence.received,
analysis.processing,
analysis.completed,
analysis.failed,
report.available

Response

Idempotent retry; no signing secret.

created
boolean
required
endpoint
object
required
signingSecret
string | null
required

Returned only on the first successful creation.