Currents Webhooks API

openapi: 3.2.0
info:
  title: Currents Dev Webhooks API
  version: 1.0.0
  contact:
    name: Currents Support
    url: https://currents.dev
  description: 'Operations tagged Webhooks across 2 of this provider''s published API definitions: currents-dev-openapi.json, currents-dev-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.currents.dev/v1
  description: Production API
- url: https://api-staging.currents.dev/v1
  description: Staging API
- url: http://localhost:4000/v1
  description: Local development
security:
- BearerAuth: []
tags:
- name: Webhooks
  description: 'Manage HTTP webhooks for projects.


    Webhooks allow you to receive HTTP POST notifications when certain events occur in your test runs:

    - **RUN_FINISH**: Run completed (passed or failed)

    - **RUN_START**: Run started

    - **RUN_TIMEOUT**: Run timed out

    - **RUN_CANCELED**: Run was cancelled


    Webhooks are useful for integrating with external tools like n8n, Zapier, or custom automation platforms.'
paths:
  /webhooks:
    get:
      summary: List webhooks
      description: Get all generic webhooks for a project
      operationId: listWebhooks
      security:
      - BearerAuth: []
      - OAuth2:
        - webhooks:read
      tags:
      - Webhooks
      parameters:
      - $ref: '#/components/parameters/ProjectIdQuery'
      responses:
        '200':
          description: List of webhooks
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookListResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    post:
      summary: Create webhook
      description: Create a new generic webhook for a project
      operationId: createWebhook
      security:
      - BearerAuth: []
      - OAuth2:
        - webhooks:write
      tags:
      - Webhooks
      parameters:
      - $ref: '#/components/parameters/ProjectIdQuery'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookRequest'
      responses:
        '201':
          description: Webhook created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    servers:
    - url: https://api.currents.dev/v1
      description: Production API
    - url: https://api-staging.currents.dev/v1
      description: Staging API
    - url: http://localhost:4000/v1
      description: Local development
  /webhooks/{hookId}:
    get:
      summary: Get webhook
      description: Get a specific webhook by ID. The hookId is globally unique, so projectId is not required.
      operationId: getWebhook
      security:
      - BearerAuth: []
      - OAuth2:
        - webhooks:read
      tags:
      - Webhooks
      parameters:
      - $ref: '#/components/parameters/HookIdPath'
      responses:
        '200':
          description: Webhook details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    put:
      summary: Update webhook
      description: Update an existing webhook. Supports partial updates. The hookId is globally unique, so projectId is not required.
      operationId: updateWebhook
      security:
      - BearerAuth: []
      - OAuth2:
        - webhooks:write
      tags:
      - Webhooks
      parameters:
      - $ref: '#/components/parameters/HookIdPath'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWebhookRequest'
      responses:
        '200':
          description: Webhook updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    delete:
      summary: Delete webhook
      description: Delete a webhook. The hookId is globally unique, so projectId is not required.
      operationId: deleteWebhook
      security:
      - BearerAuth: []
      - OAuth2:
        - webhooks:write
      tags:
      - Webhooks
      parameters:
      - $ref: '#/components/parameters/HookIdPath'
      responses:
        '200':
          description: Webhook deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookDeleteResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
    servers:
    - url: https://api.currents.dev/v1
      description: Production API
    - url: https://api-staging.currents.dev/v1
      description: Staging API
    - url: http://localhost:4000/v1
      description: Local development
components:
  parameters:
    HookIdPath:
      name: hookId
      in: path
      required: true
      description: The webhook ID (UUID)
      schema:
        type: string
        format: uuid
      example: 550e8400-e29b-41d4-a716-446655440000
    ProjectIdQuery:
      name: projectId
      in: query
      required: true
      description: The project ID
      schema:
        type: string
      example: proj_abc123
  schemas:
    WebhookListResponse:
      type: object
      required:
      - status
      - data
      properties:
        status:
          type: string
          enum:
          - OK
        data:
          type: array
          items:
            $ref: '#/components/schemas/Webhook'
    Webhook:
      type: object
      required:
      - hookId
      - projectId
      - url
      - hookEvents
      properties:
        hookId:
          type: string
          format: uuid
          description: Unique identifier for the webhook
        projectId:
          type: string
          description: Project this webhook belongs to
        url:
          type: string
          format: uri
          maxLength: 2048
          description: URL to send webhook POST requests to
        headers:
          type:
          - string
          - 'null'
          maxLength: 4096
          description: 'Custom headers as a JSON object string. Values are masked, showing only their last characters (e.g., {"Authorization": "****oken"}).'
        hookEvents:
          type: array
          items:
            $ref: '#/components/schemas/HookEvent'
          description: Events that trigger this webhook
        label:
          type:
          - string
          - 'null'
          maxLength: 255
          description: Human-readable label for the webhook
        createdAt:
          type:
          - string
          - 'null'
          format: date-time
          description: When the webhook was created
        updatedAt:
          type:
          - string
          - 'null'
          format: date-time
          description: When the webhook was last updated
    HookEvent:
      type: string
      enum:
      - RUN_FINISH
      - RUN_START
      - RUN_TIMEOUT
      - RUN_CANCELED
      description: 'The event that triggers the webhook:

        - `RUN_FINISH`: Run completed (passed or failed)

        - `RUN_START`: Run started

        - `RUN_TIMEOUT`: Run timed out

        - `RUN_CANCELED`: Run was cancelled'
    WebhookResponse:
      type: object
      required:
      - status
      - data
      properties:
        status:
          type: string
          enum:
          - OK
        data:
          $ref: '#/components/schemas/Webhook'
    ErrorResponse:
      type: object
      required:
      - status
      - error
      properties:
        status:
          type: string
          enum:
          - FAILED
        error:
          type: string
          description: Error message
        code:
          type: string
          description: Stable machine-readable discriminator, present on refusals a client is expected to branch on (for example `AI_CONSENT_REQUIRED`). The `error` text is free-form; branch on `code`.
        candidates:
          type: array
          description: 'With `code: ambiguous_target`: the runs, spec files or tests the request matched. Send one of their IDs.'
          items:
            type: object
            properties:
              runId:
                type: string
              ciBuildId:
                type: string
              instanceId:
                type: string
              groupId:
                type: string
              spec:
                type: string
              machineId:
                type:
                - string
                - 'null'
              testId:
                type: string
              title:
                type: array
                items:
                  type: string
    CreateWebhookRequest:
      type: object
      required:
      - url
      properties:
        url:
          type: string
          format: uri
          maxLength: 2048
          description: URL to send webhook POST requests to
        headers:
          type:
          - string
          - 'null'
          maxLength: 4096
          description: 'Custom headers as a JSON object string (e.g., {"Authorization": "Bearer token"})'
        hookEvents:
          type: array
          items:
            $ref: '#/components/schemas/HookEvent'
          default: []
          description: Events that trigger this webhook
        label:
          type:
          - string
          - 'null'
          minLength: 1
          maxLength: 255
          description: Human-readable label for the webhook
    WebhookDeleteResponse:
      type: object
      required:
      - status
      - data
      properties:
        status:
          type: string
          enum:
          - OK
        data:
          type: object
          required:
          - hookId
          - projectId
          properties:
            hookId:
              type: string
              format: uuid
              description: ID of the deleted webhook
            projectId:
              type: string
              description: Project the webhook belonged to
    UpdateWebhookRequest:
      type: object
      properties:
        url:
          type: string
          format: uri
          maxLength: 2048
          description: URL to send webhook POST requests to
        headers:
          type:
          - string
          - 'null'
          maxLength: 4096
          description: 'Custom headers as a JSON object string (e.g., {"Authorization": "Bearer token"}). A masked value keeps the stored value of that header; omit headers to keep them all.'
        hookEvents:
          type: array
          items:
            $ref: '#/components/schemas/HookEvent'
          description: Events that trigger this webhook
        label:
          type:
          - string
          - 'null'
          minLength: 1
          maxLength: 255
          description: Human-readable label for the webhook
  responses:
    Forbidden:
      description: 'The credential authenticated but is not permitted to use this endpoint. Five refusals share the status: a `read` API key on an endpoint that writes, an OAuth token that was not granted the scope the endpoint needs (`insufficient_scope`), an OAuth token that was granted it but whose holder no longer has a role permitting it (`insufficient_role`), an OAuth token on an endpoint that accepts an API key and nothing else (`api_key_required`), and an API key on an endpoint that answers for a user (`user_credential_required`). Discriminate on `code` rather than on the message, which is free-form. The first refusal predates the codes and sets none. Only `insufficient_scope` carries the challenge header, because it is the only one a client can act on by re-authorizing.'
      headers:
        WWW-Authenticate:
          description: 'Present on the `insufficient_scope` refusal only, naming the scope to re-authorize for (RFC 6750 3.1): `Bearer error="insufficient_scope", scope="webhooks:read"`. Absent on `insufficient_role`, where the scope is already granted, and on `api_key_required` and `user_credential_required`, where no scope would help.'
          schema:
            type: string
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            apiKeyIsReadOnly:
              summary: A read API key on an endpoint that writes
              value:
                status: FAILED
                error: 'Insufficient permissions: write access required'
            scopeNotGranted:
              summary: An OAuth token missing the endpoint's scope
              value:
                status: FAILED
                error: 'Insufficient permissions: this endpoint requires the webhooks:read scope'
                code: insufficient_scope
            scopeAboveRole:
              summary: An OAuth token holding the scope, whose holder was since demoted
              value:
                status: FAILED
                error: 'Insufficient permissions: the webhooks:write scope requires the admin role in this organization'
                code: insufficient_role
            apiKeyRequired:
              summary: An OAuth token on an endpoint that takes an API key
              value:
                status: FAILED
                error: This endpoint accepts an API key, not an OAuth access token
                code: api_key_required
            userCredentialRequired:
              summary: An API key on an endpoint that answers for a user
              value:
                status: FAILED
                error: This endpoint requires an OAuth access token or a personal access token; an API key belongs to an organization, not a user
                code: user_credential_required
    Unauthorized:
      description: Authentication failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: FAILED
            error: Invalid authentication credentials
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: FAILED
            error: Not found
    BadRequest:
      description: Invalid request parameters
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            status: FAILED
            error: 'Invalid request body: name is required'
  securitySchemes:
    RecordKey:
      type: apiKey
      in: header
      name: x-currents-key
      description: An organization's record key, the one a reporter sends. Accepted only by the two attachment routes under `/runs`, `POST /runs/{runId}/context-links`, `POST /sessions`, `POST /sessions/{sessionId}/attachments` and, for a session, `POST /share`, so a CI job can attach files, link its failed and flaky tests, record a session and share it with the key it already has.
    BearerAuth:
      type: http
      scheme: bearer
      description: 'An organization API key, sent as `Authorization: Bearer <key>`. A key carries one scope for the whole API: a `read` key reaches the GET endpoints, a `write` key reaches all of them. A `crnts_pat_` personal access token is accepted as a Bearer while its owner remains an eligible administrator in its active organization. Each operation requires the corresponding scope stored on that token.'
    OAuth2:
      type: oauth2
      description: 'An access token from the Currents authorization server, for an application acting as a user in one organization. Unlike an API key it is confined per endpoint: the operation lists the scope it needs, and a token that was not granted that scope gets 403.


        **The endpoints below are production''s.** They are written out so this specification can be exercised against production, and they are wrong for every other deployment — a token minted by `id.currents.dev` is refused by a staging or on-premise API, whose `OAUTH_ISSUER` and `OAUTH_API_AUDIENCE` are its own. Against anything but production, and in a client generated from this document, discover them instead: `GET {api origin}/.well-known/oauth-protected-resource`, then the `authorization_servers[0]` document.


        **The audience named here is the REST API''s.** `POST /mcp` is a second resource server on the same origin, identified by `{api origin}/mcp` and described by its own document at `/.well-known/oauth-protected-resource/mcp`. Every operation below refuses a token minted for it, and it refuses every token minted for these, so a client of this specification wants the audience above and not that one.'
      flows:
        authorizationCode:
          authorizationUrl: https://id.currents.dev/api/auth/oauth2/authorize
          tokenUrl: https://id.currents.dev/api/auth/oauth2/token
          refreshUrl: https://id.currents.dev/api/auth/oauth2/token
          scopes:
            projects:read: See which projects exist and their names
            projects:write: Change project configuration, including a project's tags
            results:read: See runs, specs and failure detail — errors, stacks and artifacts
            analytics:read: 'See aggregate metrics: flake and failure rates, error counts, durations and trends'
            actions:read: See quarantine and skip rules, and the tests they affect
            actions:write: Create, edit, enable, disable and archive quarantine and skip rules
            issues:write: Create and link issues in a connected issue tracker, and list its projects and issue types
            runs:write: Cancel and reset runs, and permanently delete runs and their artifacts
            webhooks:read: See webhook configuration, including destination URLs and headers
            webhooks:write: Create, edit and delete webhooks
            shares:write: Create public links to test results that anyone with the link can open until they expire
x-refined-from:
- currents-dev-openapi.json
- currents-dev-openapi.yml