Registry API
Webhooks
Signed HTTPS deliveries of domain events, with retries and redelivery.
Endpoints subscribe to package.published, version.approved, workspace.drift_detected, sync.failed and review.completed. Deliveries are signed (HMAC-SHA256, X-Workloom-Signature) and retried with exponential backoff before they are marked dead. `wl webhook` wraps these operations.
Operations
| Request | What it does |
|---|---|
| POST /webhooks/ | Register a webhook endpoint |
| GET /webhooks/ | List webhook endpoints |
| POST /webhooks/{id}/rotate-secret | Rotate an endpoint’s signing secret |
| PATCH /webhooks/{id} | Update or disable an endpoint |
| DELETE /webhooks/{id} | Delete an endpoint |
| GET /webhooks/{id}/deliveries | List deliveries for an endpoint |
| POST /webhooks/deliveries/{id}/redeliver | Requeue a delivery |
Paths come from the OpenAPI document that the API exports from its route definitions (CI fails if it is stale); this site checks its list against that file. The public registry search and package reads and the health checks work anonymously; most other operations need a signed-in session or an API key.
More areas
All areas →- 01
Public registry and blobs
Anonymous search and package pages, plus content-addressed blob storage.
- 02
Packages
Create packages, publish immutable versions, manage assets, approvals, render previews and reviews.
- 03
Workspaces
Workspace desired state: targets, revisions, the manifest the CLI pulls, overrides and policies.