iZap.ai Webhooks API

openapi: 3.2.0
info:
  contact:
    email: support@izap.ai
    name: iZap API Support
  description: Public REST API for the iZap WhatsApp business messaging platform.
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  title: iZap Webhooks API
  version: v1
servers:
- description: Production
  url: https://api.izap.ai
- description: Staging
  url: https://api-staging.izap.ai
tags:
- description: Register URLs that receive signed event deliveries when something happens in a business, rotate their signing secrets, and replay an individual delivery.
  name: Webhooks
paths:
  /api/v1/webhook-endpoints:
    get:
      description: Returns the webhook endpoints registered for the business, newest first. Signing secrets are never included — a secret is readable only in the response that creates or rotates it. The business is taken from the `business-id` header rather than the URL; the path-scoped form of this operation is deprecated.
      operationId: listCurrentWebhookEndpoints
      parameters:
      - description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
        in: header
        name: business-id
        required: true
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
          title: Business-Id
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/WebhookEndpointOut'
                title: Response List Endpoints Api V1 Webhook Endpoints Get
                type: array
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: List webhook endpoints
      tags:
      - Webhooks
    post:
      description: Registers a URL to receive signed event deliveries and returns it along with its signing secret. **The secret is shown exactly once** — store it now; afterwards you can only rotate it. The URL must be a publicly resolvable HTTPS address, and every entry in `subscribed_events` must be a known event type. Requires a plan that includes event webhooks. The business is taken from the `business-id` header rather than the URL; the path-scoped form of this operation is deprecated.
      operationId: createCurrentWebhookEndpoint
      parameters:
      - description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
        in: header
        name: business-id
        required: true
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
          title: Business-Id
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookEndpointCreate'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointCreated'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Register a webhook endpoint
      tags:
      - Webhooks
  /api/v1/webhook-endpoints/deliveries/{delivery_id}/resend:
    post:
      description: Queues a past delivery to be sent again. The stored request body is replayed byte for byte, so the original signature still verifies. Responds `202` once queued; the send itself happens in the background. The business is taken from the `business-id` header rather than the URL; the path-scoped form of this operation is deprecated.
      operationId: resendCurrentWebhookDelivery
      parameters:
      - in: path
        name: delivery_id
        required: true
        schema:
          format: uuid
          title: Delivery Id
          type: string
      - description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
        in: header
        name: business-id
        required: true
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
          title: Business-Id
      responses:
        '202':
          content:
            application/json:
              schema:
                additionalProperties:
                  type: string
                title: Response Resend Delivery Api V1 Webhook Endpoints Deliveries  Delivery Id  Resend Post
                type: object
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Resend a delivery
      tags:
      - Webhooks
  /api/v1/webhook-endpoints/{endpoint_id}:
    delete:
      description: Removes the endpoint and stops delivering to it. Past deliveries are retained. The business is taken from the `business-id` header rather than the URL; the path-scoped form of this operation is deprecated.
      operationId: deleteCurrentWebhookEndpoint
      parameters:
      - in: path
        name: endpoint_id
        required: true
        schema:
          format: uuid
          title: Endpoint Id
          type: string
      - description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
        in: header
        name: business-id
        required: true
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
          title: Business-Id
      responses:
        '204':
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Delete a webhook endpoint
      tags:
      - Webhooks
    patch:
      description: Changes an endpoint's URL, label, subscribed events or enabled state; omitted fields are left alone. Re-enabling an endpoint also clears the consecutive-failure streak that auto-disabled it, so a single later failure will not disable it again. The business is taken from the `business-id` header rather than the URL; the path-scoped form of this operation is deprecated.
      operationId: updateCurrentWebhookEndpoint
      parameters:
      - in: path
        name: endpoint_id
        required: true
        schema:
          format: uuid
          title: Endpoint Id
          type: string
      - description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
        in: header
        name: business-id
        required: true
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
          title: Business-Id
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookEndpointUpdate'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointOut'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Update a webhook endpoint
      tags:
      - Webhooks
  /api/v1/webhook-endpoints/{endpoint_id}/deliveries:
    get:
      description: Returns the endpoint's most recent deliveries, newest first (`limit`, default 50, max 200). Each carries its status (`pending`, `delivered` or `failed`), attempt count, last HTTP status code and last error. The `id` is the `izap-webhook-id` header your receiver saw, so you can match a delivery to your own logs. Request bodies are not returned; resend a delivery to receive it again.
      operationId: listWebhookDeliveries
      parameters:
      - in: path
        name: endpoint_id
        required: true
        schema:
          format: uuid
          title: Endpoint Id
          type: string
      - in: query
        name: limit
        required: false
        schema:
          default: 50
          maximum: 200
          minimum: 1
          title: Limit
          type: integer
      - description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
        in: header
        name: business-id
        required: true
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
          title: Business-Id
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/WebhookDeliveryOut'
                title: Response List Deliveries Api V1 Webhook Endpoints  Endpoint Id  Deliveries Get
                type: array
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: List an endpoint's deliveries
      tags:
      - Webhooks
  /api/v1/webhook-endpoints/{endpoint_id}/rotate-secret:
    post:
      description: Issues a new signing secret and returns it. **The previous secret stops verifying immediately** and there is no overlap window, so deploy the new one to your receiver before rotating. The business is taken from the `business-id` header rather than the URL; the path-scoped form of this operation is deprecated.
      operationId: rotateCurrentWebhookSigningSecret
      parameters:
      - in: path
        name: endpoint_id
        required: true
        schema:
          format: uuid
          title: Endpoint Id
          type: string
      - description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
        in: header
        name: business-id
        required: true
        schema:
          anyOf:
          - type: string
          - type: 'null'
          description: UUID of the business the request is scoped to. Required on this route; the deprecated /businesses/{business_id}/... form takes it from the path instead.
          title: Business-Id
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointCreated'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Missing or invalid credentials.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The credential is valid but not authorized for this action.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: The resource, or the business named in the request, does not exist.
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Unexpected error.
      security:
      - bearerAuth: []
      summary: Rotate an endpoint's signing secret
      tags:
      - Webhooks
components:
  schemas:
    ApiError:
      description: 'The response body of a handled API error.


        ``detail`` is either a plain string (FastAPI''s default for an

        ``HTTPException`` raised with a string, and for the ``default`` fastapi-users

        messages like ``"Not authenticated"``) or the structured

        :class:`ApiErrorDetail` object described above. ``code`` is present only on

        the top-level shape ``aizap.core.exceptions.AppException`` produces for its

        own 5xx responses (``"INTERNAL_ERROR"`` / ``"DB_ERROR"``); it does not

        duplicate the ``code`` nested inside a structured ``detail``.'
      properties:
        code:
          anyOf:
          - type: string
          - type: 'null'
          default: null
          title: Code
        detail:
          anyOf:
          - type: string
          - $ref: '#/components/schemas/ApiErrorDetail'
          title: Detail
      required:
      - detail
      title: ApiError
      type: object
    WebhookDeliveryOut:
      description: One delivery attempt history, without the payload. ``id`` is the ``izap-webhook-id`` header.
      properties:
        attempts:
          title: Attempts
          type: integer
        created:
          format: date-time
          title: Created
          type: string
        delivered_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          title: Delivered At
        event_type:
          title: Event Type
          type: string
        id:
          format: uuid
          title: Id
          type: string
        last_error:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Error
        last_status_code:
          anyOf:
          - type: integer
          - type: 'null'
          title: Last Status Code
        status:
          title: Status
          type: string
      required:
      - id
      - event_type
      - status
      - attempts
      - last_status_code
      - last_error
      - delivered_at
      - created
      title: WebhookDeliveryOut
      type: object
    WebhookEndpointOut:
      description: Everything about an endpoint except its secret, which is unreadable by design.
      properties:
        consecutive_failures:
          title: Consecutive Failures
          type: integer
        created:
          format: date-time
          title: Created
          type: string
        enabled:
          title: Enabled
          type: boolean
        id:
          format: uuid
          title: Id
          type: string
        label:
          title: Label
          type: string
        last_delivery_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          title: Last Delivery At
        last_error:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Error
        subscribed_events:
          items:
            type: string
          title: Subscribed Events
          type: array
        url:
          title: Url
          type: string
      required:
      - id
      - label
      - url
      - subscribed_events
      - enabled
      - consecutive_failures
      - last_error
      - last_delivery_at
      - created
      title: WebhookEndpointOut
      type: object
    WebhookEndpointCreate:
      properties:
        label:
          maxLength: 100
          minLength: 1
          title: Label
          type: string
        subscribed_events:
          items:
            type: string
          title: Subscribed Events
          type: array
        url:
          maxLength: 500
          title: Url
          type: string
      required:
      - label
      - url
      title: WebhookEndpointCreate
      type: object
    ApiErrorDetail:
      additionalProperties: true
      description: 'The structured ``detail`` object some error responses carry.


        Several handlers (the REST API plan gate, the free-tier limits, the

        webhooks entitlement gate, the closed customer-service window) raise

        ``HTTPException(detail={"code": ..., "message": ..., ...})`` — a fixed

        ``code``/``message`` pair plus extra fields specific to that error.

        ``extra="allow"`` keeps those fields in the documented shape instead of

        dropping them.'
      properties:
        code:
          title: Code
          type: string
        message:
          title: Message
          type: string
      required:
      - code
      - message
      title: ApiErrorDetail
      type: object
    WebhookEndpointUpdate:
      properties:
        enabled:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Enabled
        label:
          anyOf:
          - maxLength: 100
            minLength: 1
            type: string
          - type: 'null'
          title: Label
        subscribed_events:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Subscribed Events
        url:
          anyOf:
          - maxLength: 500
            type: string
          - type: 'null'
          title: Url
      title: WebhookEndpointUpdate
      type: object
    WebhookEndpointCreated:
      description: '``WebhookEndpointOut`` plus the one-time secret. Returned by create and rotate only.'
      properties:
        consecutive_failures:
          title: Consecutive Failures
          type: integer
        created:
          format: date-time
          title: Created
          type: string
        enabled:
          title: Enabled
          type: boolean
        id:
          format: uuid
          title: Id
          type: string
        label:
          title: Label
          type: string
        last_delivery_at:
          anyOf:
          - format: date-time
            type: string
          - type: 'null'
          title: Last Delivery At
        last_error:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Error
        signing_secret:
          title: Signing Secret
          type: string
        subscribed_events:
          items:
            type: string
          title: Subscribed Events
          type: array
        url:
          title: Url
          type: string
      required:
      - id
      - label
      - url
      - subscribed_events
      - enabled
      - consecutive_failures
      - last_error
      - last_delivery_at
      - created
      - signing_secret
      title: WebhookEndpointCreated
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
      - loc
      - msg
      - type
      title: ValidationError
      type: object
  securitySchemes:
    bearerAuth:
      description: 'Personal access token (izap_pat_…) sent as Authorization: Bearer <token>; dashboard session JWTs are also accepted.'
      scheme: bearer
      type: http