Webhooks

Manage webhook endpoints programmatically — register your receiver, list what is subscribed, and remove endpoints. For delivery format, signature verification, and retry behaviour, see the Webhooks guide.

List webhook endpoints Build and above

Returns every webhook endpoint registered for your workspace, plus the full list of subscribable event names. Signing secrets are never included in list responses.

GET/v1/headless/webhooks

Examples

cURL request

curl --request GET \
  --url "https://api.coassemble.com/api/v1/headless/webhooks" \
  --header "Authorization: COASSEMBLE:YOUR_WORKSPACE_ID:YOUR_API_KEY"

Response

JSON response

{
  "events": [
    "example"
  ],
  "endpoints": [
    {
      "id": 1234,
      "url": "example",
      "events": [
        "example"
      ],
      "dataModes": [
        "production"
      ],
      "enabled": false,
      "created": "2026-11-02T10:28:44.700Z",
      "updated": "2026-11-02T10:28:44.700Z"
    }
  ]
}

Create a webhook endpoint Build and above

Registers an endpoint and generates its signing secret.

info

The secret is returned only in this response — store it immediately. To rotate a secret, delete the endpoint and create it again.

The url must use https://.
events must contain at least one valid event name (see GET /v1/headless/webhooks for the list, e.g. course.commenced, course.completed, course.created, quiz.completed, quiz.failed, migration.progress, migration.completed).
dataModes selects ["production"] for live data, ["test"] for test mode data, or ["production", "test"] for both. At least one must be selected; omitted values default to both on workspaces restricted to test keys (Sandbox or the API Test Mode add-on), and to live data only on workspaces that can choose key modes.

POST/v1/headless/webhooks

Body parameters

Field	Type	Required	Desc	Options
`url`	`string`	Yes	HTTPS URL webhook deliveries will be POSTed to	—
`events`	`string[]`	Yes	Event names to subscribe to, e.g. course.completed	—
`enabled`	`boolean`	No		—
`dataModes`	`string[]`	No	Data to receive: production (live), test, or both. New endpoints default to both on workspaces restricted to test keys (Sandbox or API Test Mode add-on), otherwise production only.	—

Examples

cURL request

curl --request POST \
  --url "https://api.coassemble.com/api/v1/headless/webhooks" \
  --header "Authorization: COASSEMBLE:YOUR_WORKSPACE_ID:YOUR_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "url": "example",
    "events": [
        "example"
    ],
    "enabled": true,
    "dataModes": [
        "example"
    ]
}'

Response

JSON response

{
  "id": 1234,
  "url": "example",
  "events": [
    "example"
  ],
  "dataModes": [
    "production"
  ],
  "enabled": false,
  "created": "2026-11-02T10:28:44.701Z",
  "updated": "2026-11-02T10:28:44.701Z",
  "secret": "example"
}

Delete a webhook endpoint Build and above

Removes an endpoint. Deliveries stop immediately and its signing secret is invalidated.

DELETE/v1/headless/webhooks/{id}

Path parameters

Field	Description	Options
`id`	Webhook endpoint ID	—

Examples

cURL request

curl --request DELETE \
  --url "https://api.coassemble.com/api/v1/headless/webhooks/1234" \
  --header "Authorization: COASSEMBLE:YOUR_WORKSPACE_ID:YOUR_API_KEY"

Response

JSON response

{
  "success": false
}