Register a webhook endpoint
Register a webhook endpoint to receive event notifications. URL must be HTTPS and not target a private/loopback/link-local/CGNAT host (SSRF defense). Optional secret is used to compute the X-Orbit-Signature HMAC (canonical header); X-Devotel-Signature carries an identical back-compat copy. If omitted, Orbit auto-generates one and returns it in the response (this is the only time the secret is returned in cleartext — it is encrypted at rest after). See Webhook Security for verification instructions.
Authorizations
Dashboard JWT token from Clerk
Body
HTTPS endpoint URL.
"https://yourapp.com/webhooks/orbit"
Subscribed event types. See WEBHOOK_EVENT_TYPES (e.g. message.delivered, call.completed, verification.approved).
1Optional shared secret. Used to verify the X-Orbit-Signature HMAC (canonical header) on every delivery. X-Devotel-Signature carries the identical value for back-compat. Prefer X-Orbit-Signature in verifier code.
16Whether to start dispatching events immediately.
255Per-endpoint HTTP delivery timeout in seconds (1-30). The dispatcher aborts an in-flight delivery once this many seconds elapse. Defaults to 30 (the platform hard ceiling) when omitted.
1 <= x <= 30