Enterprise

Webhooks

Register HTTP endpoints to receive real-time notifications for key events: rotations, budget alerts, user changes, and more.

Enterprise feature

Webhooks are available on Enterprise plans.

Overview

Register webhook endpoints to receive HTTP POST notifications when events occur in your organization. Each webhook has an HMAC signing secret for payload verification and can subscribe to specific event types or all events.

Event Types

EventDescription
key.createAPI key created
key.revokeAPI key revoked
key.rotateAPI key rotated
user.inviteUser invited to organization
user.role_changeUser role updated
user.removeUser removed from organization
budget.warningBudget soft limit reached
budget.exceededBudget hard limit exceeded
app.createApplication created
app.deleteApplication deleted

Register a Webhook

POST
/api/v1/webhooks

Create a webhook endpoint. Requires admin role.

bash
curl -X POST https://api.ingateai.com/api/v1/webhooks \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhooks/ingate",
    "events": ["key.rotate", "budget.warning", "budget.exceeded"]
  }'

The response includes the HMAC signing secret. This is shown only at creation:

jsonResponse
{
  "id": "webhook-uuid",
  "url": "https://your-app.com/webhooks/ingate",
  "secret": "d290f1ee-6c54-4b01-90e6-d701748f0851",
  "events": ["key.rotate", "budget.warning", "budget.exceeded"],
  "active": true,
  "created_at": "2026-04-01T10:00:00Z"
}

Save the secret

The HMAC signing secret is shown only at creation time. Use it to verify that webhook payloads are genuinely from Ingate.

Webhook Payload

Events are delivered as JSON POST requests:

jsonWebhook Payload
{
  "id": "event-uuid",
  "type": "key.rotate",
  "org_id": "org-uuid",
  "timestamp": "2026-04-01T10:30:00Z",
  "data": {
    "new_key_id": "new-key-uuid",
    "overlap_hours": 24
  }
}

API Endpoints

GET
/api/v1/webhooks

List all webhooks for the current org.

GET
/api/v1/webhooks/:id

Get a specific webhook (secret is not shown).

PUT
/api/v1/webhooks/:id

Update URL, events, or active status.

DELETE
/api/v1/webhooks/:id

Delete a webhook.

Subscribe to All Events

Omit the events field or pass an empty array to subscribe to all event types:

bash
curl -X POST https://api.ingateai.com/api/v1/webhooks \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-app.com/webhooks/ingate"}'
Previous
Audit Log
Next
Bring Your Own Storage