Blueticked

Blueticked Webhooks API

Subscribe to and manage outbound event webhooks. Every delivery is a POST of a JSON envelope signed with the webhook's secret: x-blueticked-signature is sha256=, and x-blueticked-signature-v2 is t=,v1=, signed over .. Verify against the raw body before parsing, and refuse a v2 timestamp older than 300 seconds. During the 24h after a secret rotation, x-blueticked-signature-previous carries the signature made with the previous secret, and x-blueticked-signature-v2 carries a second v1 for it. Answer 2xx within 10 seconds; anything else is attempted up to 8 times in total with exponential backoff, starting at 10 seconds. Every attempt of one delivery carries the same delivery_id, which is the key to deduplicate on: the envelope's timestamp, and so the body and signature, change on each attempt. Redirects are not followed: a 3xx counts as a failed attempt.

GitHub OpenAPI

Operations 8

POST /api/v1/webhooks Create webhook subscription #
GET /api/v1/webhooks List webhook subscriptions #
POST /api/v1/webhooks/{id}/test Send test webhook #
GET /api/v1/webhook-deliveries List webhook deliveries #
POST /api/v1/webhook-deliveries/{id}/replay Replay webhook delivery #
POST /api/v1/webhooks/{id}/replay-failed Replay failed deliveries since a time #
PATCH /api/v1/webhooks/{id} Update a webhook subscription #
DELETE /api/v1/webhooks/{id} Delete a webhook subscription #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/blueticked-com/openapi/blueticked-com-webhooks-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/blueticked-com:blueticked-com-webhooks-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

blueticked-com-webhooks-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Blueticked Webhooks API
  version: 1.0.0
  description: 'Multi-channel messaging (WhatsApp, SMS, email), templates, flows, campaigns, per-recipient documents and webhooks for South African businesses, plus contacts, flows, AI agents, journeys, published sites and a commerce layer with products, orders and checkout. One send endpoint (`POST /api/v1/messages`) covers all three channels. See the request examples for the WhatsApp template, SMS, and email shapes. Authenticate every request with `Authorization: Bearer blu_live_...` (or `blu_test_...` for the sandbox). Send an `Idempotency-Key` header on the POSTs that honour it (the ones whose OpenAPI operation declares the `Idempotency-Key` parameter), and a retry of the same key replays the original response instead of repeating the write. Everywhere else the header is IGNORED, so a blind retry of a 5xx can create a second record. 29 of 48 documented POST operations deduplicate; the rest do not. ## Test mode


    Keys prefixed `blu_test_` are sandbox keys: sends never reach providers,

    never bill, and have their delivery lifecycle simulated (queued → sent →

    delivered → read, ~5s per step). Webhook deliveries fire with `"test": true`. Separately, a `test_mode: true` field on a send is a dry run that validates the

    request and returns `status: "validated"` without creating or sending anything;

    it works with any key, including a live one. Deterministic magic numbers:


    | Number | Behaviour |

    |---|---|

    | +27800000001 | Always delivers (any other number behaves the same) |

    | +27800000002 | Fails at the send step with `recipient_unreachable` |

    | +27800000003 | Delivers, then fires a simulated `message.received` reply |


    A test key''s writes are real workspace data: a contact it creates is stored like any other, where a live

    campaign could reach it. A live key refuses to send to the sandbox numbers (+27800000000 to +27800000099)

    from `POST /api/v1/messages` with 400 `validation_failed`, but a campaign or a flow does not check

    the number, so delete test contacts when you go live. ## Error codes


    | Code | Meaning |

    |---|---|

    | `invalid_field_map` | The inbound field map has an unknown or ambiguous target or repeats a contact identity target. |

    | `unauthorized` | The credential was refused: a missing or malformed Authorization header, an unknown key or a wrong secret, a revoked or expired key, an expired or revoked OAuth token, or an inactive workspace. Once a key''s secret checks out, details.reason says which (revoked, expired, workspace_inactive). |

    | `forbidden` | The credential is valid but not allowed here: a missing scope (details.required), an address outside the key''s IP allowlist, a business-restricted key on an endpoint it cannot use, or a blu_pub_ key off the agent chat endpoint or its allowed origins. |

    | `not_found` | The requested contact, template, message or campaign does not exist. |

    | `validation_failed` | The request was refused before anything happened. Either the body does not fit the schema (details is the list of schema issues, each with the field''s path), or a value breaks a rule (details names the field). |

    | `rate_limited` | The workspace or key exceeded a rate limit, or the calling address made too many failed authentication attempts. Wait Retry-After seconds, then retry. |

    | `idempotency_conflict` | The same Idempotency-Key was reused with a different body. |

    | `idempotency_in_progress` | A request with the same Idempotency-Key is still being processed; retry once it finishes. |

    | `resource_in_use` | The resource cannot be deleted because other live resources still depend on it (e.g. a group targeted by a scheduled campaign). `details` lists the dependents. |

    | `conflict` | The other kind of 409: the request collides with what already exists (a code or name that is taken, or a resource in a state the call does not accept, as when only a paid order can book a courier).'
  contact:
    name: Blueticked Developer Support
    url: https://blueticked.com/docs
    email: developers@blueticked.com
servers:
- url: https://app.blueticked.com
  description: Production
security:
- bearerAuth: []
tags:


# --- truncated at 32 KB (82 KB total) ---
# Full source: https://artifacts.apis.io/blueticked-com/openapi/blueticked-com-webhooks-api-openapi.yml