API Overview

The HookDeploy REST API provides programmatic access to endpoints, destinations, captured requests, incidents, replays, usage, members, and integration subscriptions.

Base URL

https://api.hookdeploy.dev/v1

All public routes are prefixed with /v1.

Authentication

Every request, including GET /v1/health, requires an API key in the Authorization header:

Authorization: Bearer hd_live_<your-key>

Create API keys in the dashboard under Settings → API Keys. The full key is shown once; afterward, only its prefix is visible.

Invalid, expired, or revoked keys return:

HTTP/1.1 401 Unauthorized

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

See API keys for creation and security guidance.

Response conventions

Successful resources use a data envelope:

{
  "data": { }
}

Created resources return HTTP 201. Successful deletes return HTTP 204 with no body.

Some collection endpoints currently place their list and metadata inside a second data object. The resource reference shows the exact response shape for each route; do not assume all collection envelopes are identical.

Errors use an error envelope:

{
  "error": {
    "code": "not_found",
    "message": "Endpoint not found."
  }
}

Pagination

Request lists use cursor pagination. The current response nests the list and metadata inside the top-level success envelope:

{
  "data": {
    "data": [
      {
        "id": "770e8400-e29b-41d4-a716-446655440002",
        "method": "POST",
        "captured_at": "2026-05-24T12:00:00Z"
      }
    ],
    "meta": {
      "count": 1,
      "has_more": false,
      "next_cursor": null
    }
  }
}

When data.meta.has_more is true, pass data.meta.next_cursor as the before query parameter. See Requests API for filters and complete examples.

Customer-visible errors

Webhook ingestion can separately return 429 Too Many Requests when protective limits are active. Monthly request usage is metered and resets at the start of the next calendar month (UTC); the monthly counter is not itself a hard ingestion gate.

Health check

curl -s "https://api.hookdeploy.dev/v1/health" \
  -H "Authorization: Bearer hd_live_YOUR_KEY"

{
  "data": {
    "status": "ok",
    "version": "1"
  }
}

Documented route directory

Cron jobs are managed in the dashboard and are not currently exposed through the public REST API.

Integration subscription deliveries use a 10-second delivery timeout. This is distinct from the 15-second timeout used for standard HTTPS forwarding destinations.

Resource references

• Endpoints API
• Requests API
• Destinations API
• Incidents API
• Incident subscriptions
• Replay API
• Members API
• Usage API