Register a webhook subscription
Registers an endpoint and returns its signing secret, **once**. Store the secret from this response. No endpoint returns it again. The URL must be an absolute `https` URL on a public host. Registration rejects private, loopback and link-local addresses with `invalid_webhook_url`. The webhook backend separately checks the resolved address at delivery time. Registration performs its own check so an invalid endpoint returns a readable 400 instead of silently receiving no deliveries.
POST /webhooks is not available from a browser. Call it from your server.
Registers an endpoint and returns its signing secret, once. Store the secret from this response. No endpoint returns it again.
The URL must be an absolute https URL on a public host. Registration rejects private, loopback and link-local addresses with invalid_webhook_url. The webhook backend separately checks the resolved address at delivery time. Registration performs its own check so an invalid endpoint returns a readable 400 instead of silently receiving no deliveries.
ApiKeyAuthorizationBearer <rar_live_*>Send Authorization: Bearer rar_live_..., or use rar_test_... for a test key. Both lanes currently read the same catalogue. Without a key you stay in the anonymous lane: 30 requests/minute and 1,000/day, against 60/minute per key and 2,000/day per organization with one on the Free plan. Sending a key that is malformed, revoked or unknown is a 401; sending none is not.
application/json- body
A subscription to register. Unknown properties are rejected.
url*stringAbsolute https URL on a public host. Private, loopback and link-local addresses are refused here rather than at delivery time.
^https:\/\/length <= 2048events*array<>The event types to deliver. Repeated values are folded. Today the only one emitted is card.created.
1 <= items <= 20Registered. The only response that carries the secret.
application/json- response
The subscription, plus the one and only copy of its signing secret. Store the secret before doing anything else with this response.
object*stringid*stringOpaque. Pass it to DELETE /v1/webhooks/{id}.
url*stringThe URL as registered, normalised by the URL parser.
urievents*array<>The event types delivered to this endpoint, de-duplicated.
created_at*string^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$date-timesecret*stringThe signing secret is shown once, is not stored in a readable form and cannot be retrieved again. If lost, delete the subscription and register a new one.
curl -X POST 'https://api.rarity.dev/v1/webhooks' \ -A 'my-app/1.0 (you@example.com)' \ -H 'Content-Type: application/json' \ -d '{ "url": "https://example.com/hooks/rarity", "events": [ "card.created" ]}'{ "object": "webhook", "id": "string", "url": "http://example.com", "events": [ "card.created" ], "created_at": "2019-08-24T14:15:22Z", "secret": "whsec_C2FVsBQIhrscChlQIMV+b5sSYspob7oD"}A new card print has been published, of any game. Webhook
Deduplicate on the `svix-id` header: it is the delivery id. Not sent for the first catalogue of a game in a language: that import is silent, and every print published after it is announced.
Delete a webhook subscription DELETE
Deletes one of your subscriptions and stops its deliveries. An id that is not yours is a **404**, not a 403: a 403 would confirm that it exists.