Register and manage HMAC-signed outbound webhooks.
openapi: 3.1.0
info:
title: Kita Capture Applications Webhooks API
version: v1
summary: Document intelligence — extract structured, validated, fraud-checked data from bank statements, payslips, IDs, credit reports and 30+ other document types.
description: 'Kita Capture turns scanned or photographed financial and identity documents into clean
JSON — transactions, metadata, metrics, and fraud signals. Upload a file (multipart or
base64), submit a URL, or batch up to 100 documents, then poll for results or receive an
HMAC-signed webhook.
Authentication uses an organization API key prefixed `kita_prod_` sent as
`Authorization: Bearer <key>`. Errors return `{ "error": ..., "message": ... }`.
Rate limiting is per organization; 429 responses carry a `Retry-After` header.
NOTE: Kita does not publish a machine-readable OpenAPI description. This document was
generated by the API Evangelist enrichment pipeline from Kita''s own published API
documentation (shipped verbatim inside the official `kita-docs-mcp` npm package and
served at https://www.kita.ai/documentation). Only operations, parameters, fields and
status codes that Kita documents are represented here.
'
contact:
name: Kita Support
email: support@kita.ai
url: https://www.kita.ai/documentation
x-source:
- https://www.kita.ai/documentation
- https://unpkg.com/kita-docs-mcp@0.4.0/docs/Documentation.md
x-generated-by: api-evangelist-enrichment-pipeline
x-generated: '2026-07-19'
servers:
- url: https://portal.usekita.com
description: Production (default; override with the KITA_API_URL environment variable)
security:
- BearerAuth: []
tags:
- name: Webhooks
description: Register and manage HMAC-signed outbound webhooks.
paths:
/api/v1/webhooks:
post:
tags:
- Webhooks
operationId: createWebhook
summary: Register a webhook endpoint
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/WebhookCreate'
responses:
'200':
description: Webhook registered.
content:
application/json:
schema:
$ref: '#/components/schemas/Webhook'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
get:
tags:
- Webhooks
operationId: listWebhooks
summary: List registered webhooks
responses:
'200':
description: The registered webhooks.
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/Webhook'
'401':
$ref: '#/components/responses/Unauthorized'
/api/v1/webhooks/{webhookId}:
parameters:
- $ref: '#/components/parameters/WebhookId'
get:
tags:
- Webhooks
operationId: getWebhook
summary: Get a single webhook
responses:
'200':
description: The webhook.
content:
application/json:
schema:
$ref: '#/components/schemas/Webhook'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
patch:
tags:
- Webhooks
operationId: updateWebhook
summary: Update a webhook
description: Update the URL, subscribed events, or active flag.
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/WebhookCreate'
responses:
'200':
description: Updated.
content:
application/json:
schema:
$ref: '#/components/schemas/Webhook'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
delete:
tags:
- Webhooks
operationId: deleteWebhook
summary: Delete a webhook
responses:
'200':
description: Deleted.
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
/api/v1/webhooks/{webhookId}/test:
parameters:
- $ref: '#/components/parameters/WebhookId'
post:
tags:
- Webhooks
operationId: testWebhook
summary: Send a test delivery
responses:
'200':
description: Test delivery sent.
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
/api/v1/webhooks/{webhookId}/rotate-secret:
parameters:
- $ref: '#/components/parameters/WebhookId'
post:
tags:
- Webhooks
operationId: rotateWebhookSecret
summary: Rotate the signing secret
responses:
'200':
description: The new signing secret.
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
/api/v1/webhooks/{webhookId}/secret:
parameters:
- $ref: '#/components/parameters/WebhookId'
get:
tags:
- Webhooks
operationId: getWebhookSecret
summary: Retrieve the current signing secret
responses:
'200':
description: The signing secret.
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
/api/v1/webhooks/{webhookId}/deliveries:
parameters:
- $ref: '#/components/parameters/WebhookId'
get:
tags:
- Webhooks
operationId: listWebhookDeliveries
summary: Get delivery history
description: Delivery status, attempts and latency.
responses:
'200':
description: Delivery history.
content:
application/json:
schema:
type: object
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
/api/v1/webhooks/stats:
get:
tags:
- Webhooks
operationId: getWebhookStats
summary: Get delivery aggregates
responses:
'200':
description: Aggregate delivery statistics.
content:
application/json:
schema:
type: object
'401':
$ref: '#/components/responses/Unauthorized'
/api/v1/webhooks/dlq:
get:
tags:
- Webhooks
operationId: getWebhookDeadLetterQueue
summary: Get the dead-letter queue
description: Deliveries that failed every retry.
responses:
'200':
description: Dead-lettered deliveries.
content:
application/json:
schema:
type: object
'401':
$ref: '#/components/responses/Unauthorized'
/api/v1/webhooks/validate-url:
post:
tags:
- Webhooks
operationId: validateWebhookUrl
summary: Pre-flight check a candidate webhook URL
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
url:
type: string
format: uri
responses:
'200':
description: Validation result.
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
/api/v1/webhooks/verify-signature:
post:
tags:
- Webhooks
operationId: verifyWebhookSignature
summary: Verify a sample payload signature
description: Helper that checks an `X-Kita-Signature` value against a sample body.
requestBody:
required: true
content:
application/json:
schema:
type: object
responses:
'200':
description: Verification result.
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
components:
responses:
NotFound:
description: Document or batch ID does not exist.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
BadRequest:
description: Bad request — check the request body and parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
error: Bad Request
message: documents array is required and must not be empty
Unauthorized:
description: Invalid or missing API key.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
schemas:
Error:
type: object
properties:
error:
type: string
description: Short error label.
message:
type: string
description: Human-readable description.
WebhookCreate:
type: object
properties:
url:
type: string
format: uri
events:
type: array
items:
type: string
active:
type: boolean
Webhook:
type: object
properties:
id:
type: string
url:
type: string
format: uri
events:
type: array
items:
type: string
active:
type: boolean
parameters:
WebhookId:
name: webhookId
in: path
required: true
schema:
type: string
securitySchemes:
BearerAuth:
type: http
scheme: bearer
description: 'Organization API key prefixed `kita_prod_`, issued from the Kita dashboard at
https://portal.usekita.com and sent as `Authorization: Bearer <key>`.
'