Doohick Webhooks API: Register Endpoints and Verify Events

Webhooks let your application receive real-time notifications when events happen inside Doohick. Instead of polling the API, you register a URL and Doohick sends an HTTP POST request to that URL whenever a subscribed event occurs. Use this API to create, list, and delete webhook endpoints, and follow the signature-verification guide below to ensure every delivery is authentic.

Webhook events

Subscribe to one or more of the following event types when you create a webhook. Doohick delivers a payload to your endpoint each time any subscribed event fires.

Event	Description
`resource.created`	A new resource was created in the workspace.
`resource.updated`	An existing resource was updated.
`resource.deleted`	A resource was permanently deleted.
`integration.connected`	A third-party integration was successfully connected.
`integration.failed`	A third-party integration encountered a connection error.
`member.invited`	A new member was invited to the workspace.
`billing.payment_succeeded`	A billing payment was processed successfully.
`billing.payment_failed`	A billing payment attempt failed.

`POST /webhooks`

Create a new webhook endpoint. Supply the destination URL and the list of events you want to subscribe to. Doohick returns a secret in the response — store this securely, as you will need it to verify incoming signatures.

url

string

required

The HTTPS URL Doohick should send event payloads to. Must be a publicly reachable endpoint.

events

array

required

An array of event type strings to subscribe to. Pass ["*"] to subscribe to all current and future events.

description

string

An optional human-readable label to help you identify this webhook endpoint in the dashboard.

curl -X POST https://api.doohick.com/v1/webhooks \
  -H "Authorization: Bearer dh_live_XXXXXXXXXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://yourapp.com/hooks/doohick", "events": ["resource.created", "resource.updated"]}'

const response = await fetch('https://api.doohick.com/v1/webhooks', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer dh_live_XXXXXXXXXXXXXXXXXXXX',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://yourapp.com/hooks/doohick',
    events: ['resource.created', 'resource.updated'],
    description: 'Production resource sync'
  })
});

const { data } = await response.json();
console.log('Webhook secret:', data.secret);

import requests

response = requests.post(
    'https://api.doohick.com/v1/webhooks',
    headers={
        'Authorization': 'Bearer dh_live_XXXXXXXXXXXXXXXXXXXX',
        'Content-Type': 'application/json'
    },
    json={
        'url': 'https://yourapp.com/hooks/doohick',
        'events': ['resource.created', 'resource.updated'],
        'description': 'Production resource sync'
    }
)

data = response.json()['data']
print('Webhook secret:', data['secret'])

Response 201 Created

JSON

{
  "data": {
    "id": "wh_abc123",
    "url": "https://yourapp.com/hooks/doohick",
    "events": ["resource.created", "resource.updated"],
    "description": "Production resource sync",
    "secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "status": "active",
    "workspace_id": "ws_xyz789",
    "created_at": "2024-01-15T10:00:00Z",
    "updated_at": "2024-01-15T10:00:00Z"
  }
}

data

object

required

The newly created webhook object.

Show data

string

Unique identifier for the webhook, prefixed with wh_.

url

string

The destination URL registered for this webhook.

events

array

The list of event types this webhook is subscribed to.

description

string

The optional human-readable label for this endpoint.

secret

string

The signing secret used to generate X-Doohick-Signature headers. This value is only returned once at creation time — store it securely.

status

string

Current status of the webhook endpoint. One of active or disabled.

workspace_id

string

The ID of the workspace that owns this webhook.

created_at

string

ISO 8601 timestamp indicating when the webhook was registered.

updated_at

string

ISO 8601 timestamp indicating when the webhook was last modified.

The secret field is returned only once at creation time and is never exposed again through the API. Save it to a secure secrets store immediately — if you lose it, you must delete and recreate the webhook.

`GET /webhooks`

List all webhook endpoints registered in your workspace. Results are paginated.

limit

integer

default:"20"

The maximum number of webhooks to return. Accepted range is 1–100.

offset

integer

default:"0"

The number of webhooks to skip before returning results.

curl -X GET "https://api.doohick.com/v1/webhooks?limit=20&offset=0" \
  -H "Authorization: Bearer dh_live_XXXXXXXXXXXXXXXXXXXX"

const response = await fetch('https://api.doohick.com/v1/webhooks?limit=20&offset=0', {
  headers: { 'Authorization': 'Bearer dh_live_XXXXXXXXXXXXXXXXXXXX' }
});

const { data, meta } = await response.json();
console.log(`${meta.total} webhooks registered`);

import requests

response = requests.get(
    'https://api.doohick.com/v1/webhooks',
    headers={'Authorization': 'Bearer dh_live_XXXXXXXXXXXXXXXXXXXX'},
    params={'limit': 20, 'offset': 0}
)

result = response.json()
print(f"{result['meta']['total']} webhooks registered")

Response 200 OK

JSON

{
  "data": [
    {
      "id": "wh_abc123",
      "url": "https://yourapp.com/hooks/doohick",
      "events": ["resource.created", "resource.updated"],
      "description": "Production resource sync",
      "status": "active",
      "workspace_id": "ws_xyz789",
      "created_at": "2024-01-15T10:00:00Z",
      "updated_at": "2024-01-15T10:00:00Z"
    }
  ],
  "meta": {
    "total": 3,
    "limit": 20,
    "offset": 0
  }
}

The secret field is omitted from list responses. Only the creation response includes the secret.

`DELETE /webhooks/{id}`

Delete a webhook endpoint by its ID. Doohick immediately stops delivering events to the registered URL. A successful request returns 204 No Content with an empty body.

curl -X DELETE https://api.doohick.com/v1/webhooks/wh_abc123 \
  -H "Authorization: Bearer dh_live_XXXXXXXXXXXXXXXXXXXX"

const response = await fetch('https://api.doohick.com/v1/webhooks/wh_abc123', {
  method: 'DELETE',
  headers: { 'Authorization': 'Bearer dh_live_XXXXXXXXXXXXXXXXXXXX' }
});

if (response.status === 204) {
  console.log('Webhook deleted successfully.');
}

import requests

response = requests.delete(
    'https://api.doohick.com/v1/webhooks/wh_abc123',
    headers={'Authorization': 'Bearer dh_live_XXXXXXXXXXXXXXXXXXXX'}
)

if response.status_code == 204:
    print('Webhook deleted successfully.')

Response 204 No Content The response body is empty on success.

Verifying webhook signatures

Every webhook delivery from Doohick includes an X-Doohick-Signature header containing an HMAC-SHA256 hex digest of the raw request body, signed with your webhook’s secret. Always verify this signature before processing any incoming payload to ensure the request originates from Doohick and has not been tampered with.

Always verify the X-Doohick-Signature header before trusting or acting on a webhook payload. Processing unverified payloads exposes your application to spoofed or replayed requests.

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

// Express.js example
app.post('/hooks/doohick', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-doohick-signature'];
  const isValid = verifyWebhook(req.body, signature, process.env.DOOHICK_WEBHOOK_SECRET);

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log('Received event:', event.type);
  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# Flask example
from flask import Flask, request, abort
import os

app = Flask(__name__)

@app.route('/hooks/doohick', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Doohick-Signature', '')
    is_valid = verify_webhook(
        request.get_data(),
        signature,
        os.environ['DOOHICK_WEBHOOK_SECRET']
    )

    if not is_valid:
        abort(401)

    event = request.get_json()
    print('Received event:', event['type'])
    return 'OK', 200

Test your webhook handler locally using a tunneling tool like ngrok. Run ngrok http 3000 to get a public HTTPS URL, then register it as your webhook endpoint while you develop.

​Webhook events

​POST /webhooks

​GET /webhooks

​DELETE /webhooks/{id}

​Verifying webhook signatures

Webhook events

`POST /webhooks`

`GET /webhooks`

`DELETE /webhooks/{id}`

Verifying webhook signatures