Fillo Webhooks API
The Webhooks API from Fillo — 2 operation(s) for webhooks.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/fillo-so:fillo-so-webhooks-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Fillo So Webhooks API
version: 1.0.0
contact:
name: Fillo support
email: hello@fillo.so
url: https://fillo.so/developers
description: 'Operations tagged Webhooks across 2 of this provider''s published API definitions: fillo-so-openapi.json, fillo-so-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://fillo.so
security:
- bearerAuth: []
tags:
- name: Webhooks
paths:
/api/v1/manage/forms/{form}/webhooks:
get:
tags:
- Webhooks
summary: List a form's webhooks
operationId: listFormWebhooks
description: 'The form''s signed webhooks (Zapier subscriptions excluded). Signing and receiver-authentication secrets are never returned. Scope: webhooks:manage.'
parameters:
- $ref: '#/components/parameters/FormHandle'
responses:
'200':
description: The form's webhooks.
content:
application/json:
schema:
type: object
required:
- webhooks
properties:
webhooks:
type: array
items:
$ref: '#/components/schemas/Webhook'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'429':
$ref: '#/components/responses/RateLimited'
post:
tags:
- Webhooks
summary: Add a webhook
operationId: createFormWebhook
description: 'Register a signed webhook with optional receiver authentication. The response includes the Fillo signing secret ONCE; neither it nor a receiver credential is retrievable again. Delivery URLs are SSRF-guarded and must be http(s). Scope: webhooks:manage.'
parameters:
- $ref: '#/components/parameters/FormHandle'
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- url
properties:
url:
type: string
format: uri
description: An http(s) delivery URL.
includeAbandoned:
type: boolean
default: false
description: Also deliver draft.abandoned events.
authentication:
$ref: '#/components/schemas/WebhookAuthenticationInput'
responses:
'201':
description: The created webhook, with its signing secret shown once.
content:
application/json:
schema:
$ref: '#/components/schemas/WebhookCreated'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'429':
$ref: '#/components/responses/RateLimited'
servers:
- url: https://fillo.so
/api/v1/manage/forms/{form}/webhooks/{id}:
patch:
tags:
- Webhooks
summary: Update a webhook
operationId: updateFormWebhook
description: 'Turn draft.abandoned delivery on or off, replace receiver authentication, or remove it with authentication.type none. Receiver credentials remain write-only. Scope: webhooks:manage.'
parameters:
- $ref: '#/components/parameters/FormHandle'
- $ref: '#/components/parameters/WebhookId'
requestBody:
required: true
content:
application/json:
schema:
type: object
minProperties: 1
properties:
includeAbandoned:
type: boolean
authentication:
$ref: '#/components/schemas/WebhookAuthenticationInput'
responses:
'200':
description: The webhook's updated event set.
content:
application/json:
schema:
type: object
required:
- id
- events
properties:
id:
type: string
events:
type: array
items:
type: string
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'429':
$ref: '#/components/responses/RateLimited'
delete:
tags:
- Webhooks
summary: Delete a webhook
operationId: deleteFormWebhook
description: 'Remove one of the form''s signed webhooks. Scope: webhooks:manage.'
parameters:
- $ref: '#/components/parameters/FormHandle'
- $ref: '#/components/parameters/WebhookId'
responses:
'200':
description: Deleted.
content:
application/json:
schema:
type: object
required:
- id
- deleted
properties:
id:
type: string
deleted:
type: boolean
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'429':
$ref: '#/components/responses/RateLimited'
servers:
- url: https://fillo.so
components:
responses:
NotFound:
description: No such resource in this project (returned instead of 403 for ids in other projects).
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
RateLimited:
description: Per-key (120/min), per-workspace (240/min), or per-IP (300/min) rate limit exceeded. Retry after the Retry-After header.
headers:
RateLimit-Policy:
description: Named quota policies and their limits/windows.
schema:
type: string
RateLimit:
description: Current remaining quota and seconds until reset for each named policy.
schema:
type: string
RateLimit-Limit:
description: 'Compatibility field: effective request limit.'
schema:
type: integer
RateLimit-Remaining:
description: 'Compatibility field: effective requests remaining.'
schema:
type: integer
RateLimit-Reset:
description: 'Compatibility field: seconds until the effective window resets.'
schema:
type: integer
Retry-After:
description: Seconds to wait before retrying.
schema:
type: integer
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Forbidden:
description: The key is valid but lacks the required scope.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Unauthorized:
description: Missing, malformed, unknown, revoked, or expired key.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
BadRequest:
description: Invalid request (e.g. a body on a GET/DELETE, or a missing required query parameter).
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
schemas:
WebhookCreated:
type: object
required:
- id
- url
- events
- authentication
- secret
properties:
id:
type: string
url:
type: string
format: uri
events:
type: array
items:
type: string
authentication:
type: string
enum:
- none
- bearer
- x-api-key
description: Configured receiver-authentication mode.
secret:
type: string
description: The HMAC signing secret. Shown once, never retrievable again.
Webhook:
type: object
required:
- id
- url
- events
- authentication
- createdAt
properties:
id:
type: string
url:
type: string
format: uri
events:
type: array
items:
type: string
description: Delivered event types, e.g. response.created and optionally draft.abandoned.
authentication:
type: string
enum:
- none
- bearer
- x-api-key
description: Configured receiver-authentication mode. The credential is never returned.
createdAt:
type: string
format: date-time
Error:
type: object
required:
- error
properties:
error:
type: string
WebhookAuthenticationInput:
type: object
required:
- type
description: Optional authentication Fillo adds for the receiver. For bearer or x-api-key, secret is required, encrypted at rest, and never returned.
properties:
type:
type: string
enum:
- none
- bearer
- x-api-key
secret:
type: string
minLength: 1
maxLength: 4096
writeOnly: true
parameters:
FormHandle:
name: form
in: path
required: true
description: A form id or slug.
schema:
type: string
WebhookId:
name: id
in: path
required: true
description: A webhook id.
schema:
type: string
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: 'A project secret key (`fsk_…`). Scopes: forms:read, responses:read, respondents:read, responses:export, forms:write, forms:publish, storage:manage, webhooks:manage, settings:manage, integrations:manage, responses:manage, members:manage, workspace:manage, forms:delete, responses:delete, respondents:delete, workspace:delete. A request for a scope the key lacks returns 403 with a stable message naming the scope (e.g. `This key lacks the responses:export scope.`).'
externalDocs:
description: Fillo developer resources
url: https://fillo.so/developers
x-refined-from:
- fillo-so-openapi.json
- fillo-so-openapi.json
x-provenance:
method: harvested
publisher: Fillo
source: https://fillo.so/openapi.json
note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
stamped by stamp-openapi-provenance.py (roadmap#793)