Rensei docs
API ReferenceWebhooks

Deliver a signed payload to one workflow.

Send webhook-id (1-256 URL-safe characters), webhook-timestamp (Unix seconds), and webhook-signature (lowercase hex HMAC-SHA256). Sign exact bytes: deliveryId + "." + timestamp + "." + raw body. Timestamps must be within five minutes; delivery IDs are single-use for the endpoint, including after secret rotation.

POST
/api/webhooks/workflows/{orgId}/{workflowId}/{endpointId}

Path Parameters

orgId*string
Length1 <= length <= 256
workflowId*string
Length1 <= length <= 256
endpointId*string
Length1 <= length <= 256

Request Body

application/json
  1. body
[key: string]?unknown

Response Body

Workflow instance created.

application/json
  1. response
instanceId*string
workflowId*string
status*string
Example Request
curl -X POST 'https://app.rensei.ai/api/webhooks/workflows/string/string/string' \  -H 'Content-Type: application/json' \  -d '{  "property1": null,  "property2": null}'
Example Response
{  "instanceId": "string",  "workflowId": "string",  "status": "pending"}

Inbound webhook from incident.io

Dedicated ingest endpoint for incident.io webhooks. Streams the exact provider-signed bytes under a hard 1 MiB cap before strictly decoding UTF-8. Validates the Svix `webhook-id`, `webhook-timestamp`, and `webhook-signature` headers, including a five-minute replay window, and routes only when exactly one connected per-org encrypted signing secret matches. Handles `incident.created`, `incident.updated`, and `incident.resolved` events. Unknown event types return `{ ok: true, skipped: true }`. Missing, stale, malformed, duplicate, undecryptable, or over-cap candidate state fails closed with 401. `WEBHOOK_SECRET_INCIDENT_IO` is a bounded legacy fallback for exactly one connected env-only row and is never an alternate key for connected per-org rows.

API Key Authentication

rsk_ API key management.