GogoScreen Webhooks API

openapi: 3.2.0
info:
  contact:
    email: support@gogoscreen.com
    name: GogoScreen support
    url: https://gogoscreen.com/support
  description: 'Every operation is defined once, and this document and the MCP tool list are both built from that one definition, so they cannot disagree.


    **Authentication.** `Authorization: Bearer gsk_…` (an API key) or `X-API-Key: gsk_…`. A dashboard session token in the same Bearer header is accepted so the dashboard''s developer console can call this API with the session it already has.


    **Pagination.** Cursor only. Pass `limit` (1–100, default 20) and the previous page''s `nextCursor`; a null `nextCursor` is the end of the walk. Cursors are opaque — do not build one.


    **Errors.** Every non-2xx answers `{ error: { code, message, details?, requestId } }`. Branch on `code`; quote `requestId` when reporting a failure.


    **Rate limits.** Every answer carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` (seconds). Each operation belongs to a class — read 600/min, write 120/min, expensive 20/min, charge 20/min — counted per credential, and a key may carry a lower per-minute or per-day limit of its own. Above those there is one ceiling per ACCOUNT, shared by every key and every class, so holding more keys does not raise what an account can do. A refusal is `429 rate_limited` with `Retry-After` and `details.scope` naming which ceiling it was: `minute`, `day` or `account`.


    **Long work.** Renders, storyboards, scans, generations and exports are jobs: they answer a resource with a `state` of queued/running/succeeded/failed/cancelled and a `pollAfterMs`. Poll until the state is terminal, or subscribe to a webhook.


    **Idempotency.** Every mutating operation takes an `Idempotency-Key` header; a replay with the same body returns the stored response.


    **Webhooks.** Register an endpoint with `POST /webhooks` and you are told when work finishes instead of polling for it. The secret is returned once, at registration.


    Every delivery is a `POST` of a `WebhookEvent` with these headers: `Gogoscreen-Event-Id`, `Gogoscreen-Event-Type`, `Gogoscreen-Delivery-Id`, `Gogoscreen-Delivery-Attempt` and `Gogoscreen-Signature`.


    The signature is `t=,v1=`, where the hex is `HMAC-SHA256(secret, "." + rawBody)`. **Verify it against the RAW body you received**, not against a re-serialised object — key order and whitespace are not guaranteed to survive a parse. Reject a `t` more than 300 seconds from your own clock, and compare the hex in constant time.


    Delivery is **at-least-once**: six attempts on an exponential backoff, a redirect is refused rather than followed, and only a 2xx within 10 seconds counts as delivered. Dedupe on `Gogoscreen-Event-Id`, and treat a repeat as the same event. After 20 consecutive failed deliveries an endpoint is disabled and has to be turned back on.


    The webhooks guide at https://gogoscreen.com/docs/webhooks has a short verifier example.'
  license:
    name: GogoScreen API Terms
    url: https://gogoscreen.com/terms
  summary: Make product walkthroughs and marketing videos from a URL.
  title: GogoScreen Webhooks API
  version: 1.0.0
servers:
- url: https://api.gogoscreen.com/api/v1
tags:


# --- truncated at 32 KB (64 KB total) ---
# Full source: https://artifacts.apis.io/gogoscreen-com/openapi/gogoscreen-com-webhooks-api-openapi.yml