Create a pull endpoint

POST

/v1/pull-endpoints

curl --request POST \
  --url https://api.hookbridge.io/v1/pull-endpoints \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "Shopify events", "verify_hmac": true, "hmac_header_name": "X-Shopify-Hmac-Sha256", "hmac_signature_encoding": "base64", "hmac_secret": "your-shopify-app-secret" }'

• Production

Creates a new pull mode endpoint. Pull endpoints receive webhooks from external providers and store events for consumer-controlled retrieval via the API, instead of forwarding them.

Authorizations

• BearerAuth

Request Body^required

Media typeapplication/json

object

name

Human-readable name

string

<= 255 characters

description

Description of this endpoint’s purpose

string

<= 500 characters

retention_days

Per-endpoint retention override (default is plan default)

integer

>= 1

event_type_source

Where to extract the event type from incoming webhooks

string

Allowed values: body header

event_type_path

JSON path for body extraction (e.g., “type”) or header name (e.g., “X-GitHub-Event”)

string

<= 256 characters

verify_static_token

boolean

token_header_name

string

token_query_param

string

token_value

string

>= 16 characters

verify_hmac

boolean

hmac_header_name

string

hmac_signature_encoding

How the HMAC signature header value is encoded. Use base64 for providers that send a base64 signature (for example Shopify’s X-Shopify-Hmac-Sha256); hex for hex-encoded signatures. Base64 is standard RFC 4648 with padding. Only used when verify_hmac is true.

string

default: hex

Allowed values: hex base64

hmac_secret

string

timestamp_header_name

string

timestamp_ttl_seconds

integer

verify_ip_allowlist

boolean

allowed_cidrs

Array<string>

idempotency_header_names

Array<string>

ingest_response_code

integer

default: 202 >= 200 <= 299

Examples

Examplewith_base64_hmac

Shopify-style pull endpoint with base64 HMAC signature

{
  "name": "Shopify events",
  "verify_hmac": true,
  "hmac_header_name": "X-Shopify-Hmac-Sha256",
  "hmac_signature_encoding": "base64",
  "hmac_secret": "your-shopify-app-secret"
}

Responses

201

Pull endpoint created

Media typeapplication/json

object

data

object

id

required

string format: uuid

name

string

description

string

mode

required

string

Allowed values: pull

ingest_url

required

URL to give to your webhook provider. Does not include the secret token suffix.

string format: uri

active

required

Whether the endpoint is active (not deleted).

boolean

paused

required

boolean

retention_days

integer

nullable

event_type_source

string

Allowed values: body header

event_type_path

string

counts

Event counts (only on single-endpoint GET, not list)

object

stored

integer

fetched

integer

delivered

integer

total

integer

verify_static_token

boolean

token_header_name

string

token_query_param

string

verify_hmac

boolean

hmac_header_name

string

hmac_signature_encoding

How the HMAC signature header value is encoded (hex or base64). Only used when verify_hmac is true.

string

default: hex

Allowed values: hex base64

timestamp_header_name

string

timestamp_ttl_seconds

integer

nullable

verify_ip_allowlist

boolean

allowed_cidrs

Array<string>

ingest_response_code

integer

idempotency_header_names

Array<string>

created_at

required

string format: date-time

updated_at

required

string format: date-time

secret_token

Secret token for the ingestion URL. Shown only once at creation time.

string

ingest_url

required

Full ingestion URL including the secret token suffix.

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "data": {
    "mode": "pull",
    "event_type_source": "body",
    "hmac_signature_encoding": "hex"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

400

Invalid request

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Examples

Endpoint not found

{
  "error": {
    "code": "ENDPOINT_NOT_FOUND",
    "message": "endpoint not found"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid endpoint ID format

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "endpoint_id must be in format ep_xxx"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid payload

{
  "error": {
    "code": "INVALID_REQUEST",
    "message": "payload must be valid JSON"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

Invalid headers

{
  "error": {
    "code": "INVALID_HEADERS",
    "message": "header 'Host' is forbidden and cannot be overridden"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}

401

Unauthorized - Invalid or missing API key

Media typeapplication/json

object

error

object

code

Machine-readable error code

string

message

Human-readable error message

string

meta

object

request_id

Unique identifier for this request (useful for support)

string

Example

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  },
  "meta": {
    "request_id": "req_xyz123"
  }
}