curl --request POST \
--url https://api.signuprisk.com/v1/dashboard/webhooks \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "<string>",
"events": []
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({url: '<string>', events: []})
};
fetch('https://api.signuprisk.com/v1/dashboard/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.signuprisk.com/v1/dashboard/webhooks"
payload = {
"url": "<string>",
"events": []
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.signuprisk.com/v1/dashboard/webhooks"
payload := strings.NewReader("{\n \"url\": \"<string>\",\n \"events\": []\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"webhook": {
"id": "<string>",
"url": "<string>",
"events": [
"signup.high_risk"
],
"high_risk_threshold": 123,
"redact_email": true,
"is_active": true,
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"secret": "<string>"
},
"metadata": {
"warnings": [
{
"code": "<string>",
"message": "<string>",
"type": "<string>",
"upgrade_required": true,
"recommended_plan": "<string>",
"required_plan": "<string>"
}
]
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}Create an outbound webhook (dashboard, reveal-once secret)
Clerk-session-protected (APP-008). Registers an HTTPS endpoint, selects
supported events, and returns the reveal-once signing secret exactly
once (Cache-Control: private, no-store + Pragma: no-cache). The
browser never supplies account_id, id, secret, is_active, or timestamps.
Plan gate: webhooks require Scale+ (403 FEATURE_NOT_AVAILABLE below).
The server performs final destination/SSRF validation at delivery time.
curl --request POST \
--url https://api.signuprisk.com/v1/dashboard/webhooks \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"url": "<string>",
"events": []
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({url: '<string>', events: []})
};
fetch('https://api.signuprisk.com/v1/dashboard/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.signuprisk.com/v1/dashboard/webhooks"
payload = {
"url": "<string>",
"events": []
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.signuprisk.com/v1/dashboard/webhooks"
payload := strings.NewReader("{\n \"url\": \"<string>\",\n \"events\": []\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"webhook": {
"id": "<string>",
"url": "<string>",
"events": [
"signup.high_risk"
],
"high_risk_threshold": 123,
"redact_email": true,
"is_active": true,
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"secret": "<string>"
},
"metadata": {
"warnings": [
{
"code": "<string>",
"message": "<string>",
"type": "<string>",
"upgrade_required": true,
"recommended_plan": "<string>",
"required_plan": "<string>"
}
]
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}{
"error": {
"code": "MISSING_API_KEY",
"message": "<string>",
"type": "authentication_error",
"request_id": "<string>",
"retryable": true,
"details": {},
"action": {
"type": "upgrade_plan",
"url": "<string>",
"label": "<string>",
"required_plan": "<string>"
},
"field_errors": [
{
"field": "<string>",
"code": "<string>",
"message": "<string>"
}
],
"retry_after_seconds": 123,
"upgrade_required": true,
"required_plan": "<string>",
"recommended_plan": "<string>"
}
}Authorizations
Clerk dashboard session JWT. Used on dashboard, billing, playground, and admin console routes only:
Authorization: Bearer <Clerk session JWT>
These are human-session credentials, not API keys. The dashboard
frontend must never send authoritative account IDs, plan values, quota
counters, Stripe IDs, or API-key actor fields — the server derives
ownership from the session. Admin console routes additionally require
the custom admin_role claim (admin or support) on the same
verified session JWT; writes require admin.
Body
HTTPS endpoint to deliver events to.
signup.high_risk, bulk.job_completed Score threshold for signup.high_risk delivery.
1 <= x <= 100Redact the email from the delivered payload.