Webhooks · API · Dustin's Designer Den

GET /api/v1/webhooks Scope webhooks:write

List the webhooks this app registered

Only the endpoints YOUR app registered for this designer. Ones belonging to other apps are never visible.

Each entry reports is_active, last_delivered_at, last_status and consecutive_failures, which is enough to show an integration-health panel, or to notice that an endpoint was switched off after repeated failures and needs registering again.

curl "https://dustinsdesignerden.com/api/v1/webhooks" \
  -H "Authorization: Bearer $DDD_TOKEN"

const res = await fetch('https://dustinsdesignerden.com/api/v1/webhooks', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${token}`,
  },
});

const data = await res.json();

$response = Http::withToken($token)->get('https://dustinsdesignerden.com/api/v1/webhooks');

$data = $response->json();

res = requests.get(
    'https://dustinsdesignerden.com/api/v1/webhooks',
    headers={'Authorization': f'Bearer {token}'},
)

data = res.json()

Response 200

{
    "data": [
        {
            "id": 1,
            "url": "https://yourtool.example.com/hooks/ddd",
            "events": [
                "components.changed"
            ],
            "is_active": true,
            "last_delivered_at": null,
            "last_status": null,
            "consecutive_failures": 0,
            "created_at": "2026-08-01T16:20:39+00:00"
        }
    ]
}

Response: Webhook

id integer: Webhook id, used to delete it.
url string: Where deliveries are POSTed.
events array: Events this endpoint receives.
is_active boolean: Set to false automatically after repeated delivery failures.
last_delivered_at string|null: When a delivery last succeeded.
last_status integer|null: HTTP status your endpoint last returned.
consecutive_failures integer: Resets to zero on any success.
created_at string: ISO 8601 timestamp.
secret string: Signing secret. Returned ONLY when the webhook is created, and never again.

POST /api/v1/webhooks Scope webhooks:write

Register a webhook

Returns secret exactly once. Store it, you cannot read it back. Sign checks use X-DDD-Signature: sha256=HMAC_SHA256("{timestamp}.{body}", secret) with the timestamp from X-DDD-Timestamp.

Events: components.changed, project.updated. Public http(s) URLs only. Max 10 per app per account.

curl -X POST "https://dustinsdesignerden.com/api/v1/webhooks" \
  -H "Authorization: Bearer $DDD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourtool.example.com/hooks/ddd",
    "events": [
        "components.changed"
    ]
}'

const res = await fetch('https://dustinsdesignerden.com/api/v1/webhooks', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
      "url": "https://yourtool.example.com/hooks/ddd",
      "events": [
          "components.changed"
      ]
  }),
});

const data = await res.json();

$response = Http::withToken($token)->post('https://dustinsdesignerden.com/api/v1/webhooks', [
    'url' => 'https://yourtool.example.com/hooks/ddd',
    'events' => [
        'components.changed',
    ],
]);

$data = $response->json();

res = requests.post(
    'https://dustinsdesignerden.com/api/v1/webhooks',
    headers={'Authorization': f'Bearer {token}'},
    json={
    'url': 'https://yourtool.example.com/hooks/ddd',
    'events': [
        'components.changed'
    ]
},
)

data = res.json()

Response 201

{
    "id": 1,
    "url": "https://yourtool.example.com/hooks/ddd",
    "events": [
        "components.changed"
    ],
    "is_active": true,
    "last_delivered_at": null,
    "last_status": null,
    "consecutive_failures": 0,
    "created_at": "2026-08-01T16:20:39+00:00",
    "secret": "whsec_epwMrVcFIU1NYOpQn5WkGd5DqWHHkGwcHMEBWi2H"
}

Body parameters

url url required: Public https endpoint to POST to. Same address rules as asset fetching.
events array required: Which events to receive. See the event list under Webhooks.

Response: Webhook

id integer: Webhook id, used to delete it.
url string: Where deliveries are POSTed.
events array: Events this endpoint receives.
is_active boolean: Set to false automatically after repeated delivery failures.
last_delivered_at string|null: When a delivery last succeeded.
last_status integer|null: HTTP status your endpoint last returned.
consecutive_failures integer: Resets to zero on any success.
created_at string: ISO 8601 timestamp.
secret string: Signing secret. Returned ONLY when the webhook is created, and never again.

DELETE /api/v1/webhooks/{webhook} Scope webhooks:write

Delete a webhook

Stops deliveries and removes the registration. Anything still queued is dropped too, because every delivery re-checks that its webhook exists before sending.

There is no way to edit a webhook. To change its URL or its events, delete it and register again, which also issues a fresh secret.

curl -X DELETE "https://dustinsdesignerden.com/api/v1/webhooks/1" \
  -H "Authorization: Bearer $DDD_TOKEN"

const res = await fetch('https://dustinsdesignerden.com/api/v1/webhooks/1', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${token}`,
  },
});

const data = await res.json();

$response = Http::withToken($token)->delete('https://dustinsdesignerden.com/api/v1/webhooks/1');

$data = $response->json();

res = requests.delete(
    'https://dustinsdesignerden.com/api/v1/webhooks/1',
    headers={'Authorization': f'Bearer {token}'},
)

data = res.json()

Response 200

{
    "deleted": true
}

Parameters

webhook integer · path required: Webhook id.

Response: Deletion result

deleted boolean|integer: true for a single delete, or the number removed for a bulk one.
components_retained boolean: Only on a group delete. Confirms removing the deck or stack left its components in the project.