Webhook API

DeadHook's public machine-to-machine API surface is webhook ingestion:

POST {DEADHOOK_INGEST_URL}

The complete URL is shown on each Source. It includes the Source locator; the Source signing secret authenticates the request. Keep both the URL and the secret out of public repositories.

Source and Destination configuration is handled securely in the DeadHook dashboard. Dashboard credentials are not part of the ingestion integration.

Supported integration points

Integration	Documentation
Send a signed provider Event	Ingestion API
Configure a provider authentication method	Configuring Sources
Receive and verify a DeadHook outbound webhook	Configuring Destinations
Understand retries, DLQ, and replay	Delivery lifecycle

Ingestion contract

• Accepts the original raw request body.
• Supports Standard Webhooks, generic bearer, Stripe, and Shopify verification.
• Default body limit: 256 KiB.
• Returns 202 when accepted, 200 for an exact duplicate, and a problem response on failure.
• Accepts 202 only after DeadHook records the Event and queues its initial Delivery work.

Ingestion success does not mean a Destination was contacted or succeeded. See Ingestion API for headers, responses, deduplication, and errors.

Outbound webhooks

DeadHook signs every attempt with the Destination signing secret. The outbound contract uses webhook-id, webhook-timestamp, and webhook-signature; see Configuring Destinations.

Need the dashboard?

Sign in to manage Sources, Destinations, and Events. Dashboard credentials belong only in the dashboard—never in an ingestion integration.