Observability Tools
Where to look when something did not happen: webhook endpoints and their deliveries, the activity log of every mutation, and the status of a job another tool queued.
Where to look when something did not happen: webhook endpoints and their deliveries, the activity log of every mutation, and the status of a job another tool queued. These tools read and replay that record.
Tools
create_webhook_endpointCreate Webhook EndpointDESTRUCTIVEdelete_webhook_endpointDelete Webhook EndpointREADget_activity_logActivity LogASYNCget_job_statusPoll MCP Async JobREADget_webhook_deliveryGet Webhook DeliveryREADget_webhook_endpointGet Webhook EndpointREADlist_webhook_deliveriesList Webhook DeliveriesREADlist_webhook_endpointsList Webhook EndpointsDESTRUCTIVEpause_webhook_endpointPause Webhook EndpointDESTRUCTIVEresume_webhook_endpointResume Webhook EndpointDESTRUCTIVEretry_dead_webhook_deliveriesRetry Dead Webhook DeliveriesDESTRUCTIVEretry_webhook_deliveryRetry Webhook DeliveryDESTRUCTIVErotate_webhook_endpoint_secretRotate Webhook Endpoint SecretDESTRUCTIVEtest_webhook_endpointTest Webhook Endpointcreate_webhook_endpoint
DESTRUCTIVERegister an outbound webhook endpoint for the token's team. The signing secret is returned in this response only.
Register a URL for Subscriby to post events to, with the event names it should receive. The
endpoint belongs to the token's team; pass project_id to deliver only one project's events.
The secret is returned once
The response carries secret alongside the endpoint row. It is the HMAC key
every delivery to this endpoint is signed with, it is never readable again —
not by get_webhook_endpoint, not by the
dashboard — and it can only be replaced with
rotate_webhook_endpoint_secret.
Hand it to the consumer immediately. This is the one exception to the server's
rule that a secret is never surfaced.
The URL must be https and resolve to a public address; http and private-network targets are
refused. Deliveries start at once unless is_active is false.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. It reaches beyond Subscriby: a connector, a provider or a member.
Arguments
name*stringA label for the endpoint, shown in the dashboard.
url*stringThe https URL Subscriby posts events to. Must resolve to a public address; http and private-network targets are refused.
events*string[]Event names to deliver, from subscriby://enums/webhook-event. At least one.
project_idstringoptionalOptional project UUID: deliver only that project's events. Omit for every project of the team.
allowed_ipsstring[]optionalOptional list of IP addresses or CIDR ranges the endpoint host may resolve to; a delivery whose host resolves outside the list is dead-lettered without being posted.
is_activebooleanoptionalWhether deliveries start right away. Defaults to true.
What it returns
{ "data": { "id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "name": "CRM sync", "url": "https://hooks.example.com/subscriby", "project_id": null, "events": ["subscription.created", "subscription.cancelled"], "is_active": true, "disabled_at": null, "allowed_ips": [], "failure_count": 0, "consecutive_failures": 0, "last_success_at": null, "last_failure_at": null, "created_at": "2026-09-06T09:20:00+00:00", "secret": "whsec_..." }}Every event name must be one the token could subscribe to: each event requires the ability of its
family (subscription.* needs project-subscription:view, and so on), which is checked at
registration.
How it fails
VALIDATION_FAILEDper field: an http or private-network URL, an empty or unknown events list, an event the token cannot subscribe to, an allowed_ips entry that is neither an IP address nor a CIDR range.
RESOURCE_NOT_FOUNDunknown project_id, or a project outside the token's scope.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:create.
delete_webhook_endpoint
DESTRUCTIVERemove an outbound webhook endpoint. Destructive — an integration listening on it goes dark at once; its delivery log is kept.
Remove an endpoint the team no longer wants. Deliveries to it stop immediately and its delivery log
is kept for reference. If the intent is "stop it for now",
pause_webhook_endpoint does that reversibly and keeps the
secret.
Destructive — confirm the endpoint with a human first
Whatever is listening on the URL stops receiving events with no notice.
Confirm the exact endpoint_id with the creator before calling.
Only the creator who registered the endpoint, or the team owner, may remove it; a fellow team member
is refused with FORBIDDEN. Idempotent: an already-deleted id surfaces as RESOURCE_NOT_FOUND,
exactly as an unknown or foreign id does.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. Sending the same arguments twice changes nothing the second time.
Arguments
endpoint_id*stringUUID of the webhook endpoint to remove.
What it returns
{ "data": { "endpoint_id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "deleted": true }}How it fails
FORBIDDENthe token belongs to a team member who did not register the endpoint and is not the team owner.
VALIDATION_FAILEDthe removal was refused for the endpoint's current state.
RESOURCE_NOT_FOUNDunknown or already-deleted endpoint_id, or an endpoint of another team.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:delete.
get_activity_log
READRead the activity log for a given subject. Returns chronological entries with causer, event, and scrubbed properties.
Read the activity log for a given subject (e.g. a project or project-user). Returns reverse-chronological entries with causer, event, and properties. Keys matching token | secret | password | api_key | api_secret are stripped before the response returns.
Pass a short morph alias as subject_type — project,
project-subscription, project-subscription-plan, project-user,
project-resource, etc. The subject_id is the row UUID.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
subject_type*stringAlias of the model the activity is attached to: one of project, subscription, project-subscription, member, project-user, plan, project-subscription-plan, access-code, coupon, project-resource. Model class names are refused.
subject_id*stringUUID of the subject row.
limitintegeroptionalMaximum entries to return (1..200, default 50).
1max200What it returns
{ "data": [ { "id": "92e4c1b6-70da-4f38-8517-b036ae94d7c2", "log_name": "default", "description": "Plan 'Premium Monthly' was updated.", "event": "updated", "subject_type": "project-subscription-plan", "subject_id": "c4e82f16-93a7-4d5b-b81c-6e0f27a94d3b", "causer_type": "user", "causer_id": "2a91c4e7-6f38-4b52-8e0d-9c1a7b3f5d80", "properties": { "changes": { "price": { "from": "25.00", "to": "29.00" } } }, "actor_kind": "human", "created_at": "2026-05-18T10:05:00Z" } ], "meta": { "subject_type": "project-subscription-plan", "subject_id": "c4e82f16-93a7-4d5b-b81c-6e0f27a94d3b", "total": 12, "limit": 50 }}How it fails
TOKEN_MISSING_ABILITYtoken lacks activity:read.
VALIDATION_FAILEDsubject_type is not one of the supported aliases (model class names are refused; the error context lists the aliases), or subject_id is not a UUID (reason: not_a_uuid).
RESOURCE_NOT_FOUNDthe subject does not exist, belongs to another creator, or sits outside the token's scope:project: allow-list. The history is never read before the subject itself resolves, so a foreign id learns nothing.
get_job_status
ASYNCPoll a long-running MCP job by id. Returns the current status plus result or error once the worker finishes.
Poll a long-running MCP job by id. Returns the current status plus result or error once the worker finishes.
Status values: queued → running → completed | failed.
Pair it with any tool that hands back a job_id. Today only bulk_generate_access_codes enqueues one.
Annotations
It reads and never changes anything.
Arguments
job_id*stringUUID of the async job to poll.
What it returns
{ "data": { "job_id": "0a4e7b96-c358-4d12-9f6b-25a8013ce74f", "tool_name": "bulk_generate_access_codes", "status": "completed", "result": { "count": 50, "batch_unique_key": "..." }, "error": null, "started_at": "2026-05-18T10:05:00Z", "completed_at": "2026-05-18T10:05:04Z" }}result and error are both null until the worker finishes; exactly one is populated afterwards. started_at is null while the job is still queued.
How it fails
AUTHENTICATION_REQUIREDno authenticated user on the request.
RESOURCE_NOT_FOUNDunknown job_id, or the job was started by a different user.
One outbound webhook delivery by UUID — its event, status, attempts, the payload that was posted and what the endpoint answered.
Read one delivery back, typically the row test_webhook_endpoint
returned or one picked out of list_webhook_deliveries, to see
whether the worker has posted it yet and what the target said. The row shape is the list's.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
delivery_id*stringUUID of the webhook delivery to fetch.
What it returns
{ "data": { "id": "34f1d78e-05a2-4b69-8c3d-7e921ab06f45", "endpoint_id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "event": "subscription.created", "event_id": "01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "status": "delivered", "attempts": 3, "response_status": 200, "response_excerpt": "{\"ok\":true}", "payload": { "id": "evt_01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "type": "subscription.created", "created_at": "2026-09-06T10:05:00+00:00", "api_version": "2026-05-01", "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13", "data": { "subscription_id": "5b7e2d40-1a86-4c39-97f2-e83d0b16c5a4" } }, "next_attempt_at": null, "delivered_at": "2026-09-06T10:31:00+00:00", "dead_lettered_at": null, "created_at": "2026-09-06T10:05:00+00:00" }}attempts counts every post made so far, so a delivered row with attempts: 3 succeeded on the
third try. event_id is the envelope's id without its evt_ prefix — the same value the
consumer saw in the SB-Event-Id header, which is how a row here is matched to a line in the
consumer's own log.
How it fails
RESOURCE_NOT_FOUNDunknown delivery_id, or a delivery to another team's endpoint.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-delivery:view-any.
One of the team's outbound webhook endpoints by UUID, with its health counters. The signing secret is never returned.
Read one endpoint back: its target, the events it receives, whether it is active, and the health
counters the dashboard shows — total failures, the current consecutive-failure streak and the last
success and failure instants. The row is the one
list_webhook_endpoints returns.
Never the secret
The signing secret exists in the
create_webhook_endpoint and
rotate_webhook_endpoint_secret
responses only. If a consumer has lost it, rotate.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
endpoint_id*stringUUID of the webhook endpoint to fetch.
What it returns
{ "data": { "id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "name": "CRM sync", "url": "https://hooks.example.com/subscriby", "project_id": null, "events": ["subscription.created", "subscription.cancelled"], "is_active": true, "disabled_at": null, "allowed_ips": [], "failure_count": 2, "consecutive_failures": 0, "last_success_at": "2026-09-05T18:00:00+00:00", "last_failure_at": "2026-08-30T07:12:00+00:00", "created_at": "2026-05-18T10:05:00+00:00" }}consecutive_failures is the streak that disables an endpoint when it runs too long;
failure_count is the lifetime total. disabled_at is set when the endpoint is paused, by a
person or by the streak.
How it fails
RESOURCE_NOT_FOUNDunknown endpoint_id, or an endpoint of another team.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:view.
The team's outbound webhook delivery log, newest first — what was posted, what the endpoint answered, and where each row is on the retry ladder.
Every event Subscriby posts to one of the team's endpoints is a delivery: one row per endpoint
per event, with the signed envelope that was sent, the target's response status and an excerpt of
its body, and the row's position on the retry ladder. This is the dashboard's delivery log over
MCP, for seeing why a consumer rejected an event before deciding to
retry_webhook_delivery or
retry_dead_webhook_deliveries.
The status tabs
pending — queued or waiting for its next attempt; delivered — the target
answered 2xx; failed — the last attempt failed and the ladder has more
tries; dead — the ladder ran out, and only a retry brings it back. all is
the default. Anything else is VALIDATION_FAILED.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
statusstringoptionalTab of the delivery log: all, pending, delivered, failed or dead. Defaults to all.
limitintegeroptionalMaximum deliveries to return per page (1..100).
1max100pageintegeroptional1-indexed page number.
1What it returns
{ "data": [ { "id": "34f1d78e-05a2-4b69-8c3d-7e921ab06f45", "endpoint_id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "event": "subscription.created", "event_id": "01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "status": "failed", "attempts": 2, "response_status": 500, "response_excerpt": "upstream unavailable", "payload": { "id": "evt_01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "type": "subscription.created", "created_at": "2026-09-06T10:05:00+00:00", "api_version": "2026-05-01", "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13", "data": { "subscription_id": "5b7e2d40-1a86-4c39-97f2-e83d0b16c5a4" } }, "next_attempt_at": "2026-09-06T10:15:00+00:00", "delivered_at": null, "dead_lettered_at": null, "created_at": "2026-09-06T10:05:00+00:00" } ], "meta": { "page": 1, "limit": 25, "total": 312, "has_more": true }}payload is the envelope exactly as the endpoint received it, so a consumer's bug can be reproduced
from the log. response_excerpt is the first few kilobytes of the target's body, not the whole
response.
How it fails
VALIDATION_FAILEDstatus is not one of the five tabs, or limit/page is out of range.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-delivery:view-any.
List outbound webhook endpoints registered for the caller's team. Optional project_id filter, optional active_only filter. Secrets are never returned.
List outbound webhook endpoints registered for the caller's team. Optionally scoped to a single project, or filtered to active endpoints only. Useful for sanity-checking integrations after a suspected outage.
Endpoint secrets are never returned by this tool. They are surfaced only at
the moment of creation or rotation via the dashboard or the rotate-secret
REST endpoint.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
It reads and never changes anything.
Arguments
project_idstringoptionalOptional project UUID. Omit to list team-wide endpoints and all project-scoped endpoints within the team.
active_onlybooleanoptionalWhen true, hides endpoints with is_active=false or disabled_at set.
What it returns
{ "data": [ { "id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "name": "Zapier trigger", "url": "https://hooks.zapier.com/...", "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13", "events": ["subscription.created", "payment.succeeded"], "is_active": true, "disabled_at": null, "allowed_ips": null, "failure_count": 0, "consecutive_failures": 0, "last_success_at": "2026-05-18T10:05:00Z", "last_failure_at": null, "created_at": "2026-04-01T10:05:00Z" } ], "meta": { "total": 3 }}How it fails
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:manage.
pause_webhook_endpoint
DESTRUCTIVEStop deliveries to an endpoint without removing it. Events raised while paused are not queued for it.
The dashboard's on/off switch for an endpoint. A paused endpoint keeps its secret, its event
subscriptions and its delivery log; what stops is new deliveries. Use it during a consumer outage or
a migration, then resume_webhook_endpoint.
Paused events are not replayed
Events raised while the endpoint is paused are not queued for it, so they
are gone for that endpoint when it resumes. If the consumer must see
everything, leave the endpoint on and let the retry ladder and
retry_dead_webhook_deliveries
carry it through the outage instead.
Only the creator who registered the endpoint, or the team owner, may pause it; a fellow team member
is refused with FORBIDDEN. Idempotent: an already-paused endpoint is a no-op.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. Sending the same arguments twice changes nothing the second time.
Arguments
endpoint_id*stringUUID of the webhook endpoint to pause.
What it returns
{ "data": { "id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "name": "CRM sync", "url": "https://hooks.example.com/subscriby", "project_id": null, "events": ["subscription.created", "subscription.cancelled"], "is_active": false, "disabled_at": "2026-09-06T09:20:00+00:00", "allowed_ips": [], "failure_count": 2, "consecutive_failures": 0, "last_success_at": "2026-09-05T18:00:00+00:00", "last_failure_at": "2026-08-30T07:12:00+00:00", "created_at": "2026-05-18T10:05:00+00:00" }}How it fails
FORBIDDENthe token belongs to a team member who did not register the endpoint and is not the team owner.
VALIDATION_FAILEDthe pause was refused for the endpoint's current state.
RESOURCE_NOT_FOUNDunknown endpoint_id, or an endpoint of another team.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:update.
resume_webhook_endpoint
DESTRUCTIVEStart deliveries to a paused endpoint again and clear its failure streak. Events raised while paused are not replayed.
The reverse of pause_webhook_endpoint, and also the way to
bring back an endpoint the failure streak disabled. Resuming clears the consecutive-failure count,
so a target that was fixed while paused is not disabled again on its first miss.
Nothing is replayed on resume
Events raised while the endpoint was paused were never queued for it and are
not sent now. Rows that dead-lettered before the pause are a different
matter: replay those with
retry_dead_webhook_deliveries
once the consumer is healthy.
Only the creator who registered the endpoint, or the team owner, may resume it; a fellow team member
is refused with FORBIDDEN. Idempotent: an already-active endpoint is a no-op.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. Sending the same arguments twice changes nothing the second time.
Arguments
endpoint_id*stringUUID of the webhook endpoint to resume.
What it returns
{ "data": { "id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "name": "CRM sync", "url": "https://hooks.example.com/subscriby", "project_id": null, "events": ["subscription.created", "subscription.cancelled"], "is_active": true, "disabled_at": null, "allowed_ips": [], "failure_count": 2, "consecutive_failures": 0, "last_success_at": "2026-09-05T18:00:00+00:00", "last_failure_at": "2026-08-30T07:12:00+00:00", "created_at": "2026-05-18T10:05:00+00:00" }}How it fails
FORBIDDENthe token belongs to a team member who did not register the endpoint and is not the team owner.
VALIDATION_FAILEDthe resume was refused for the endpoint's current state.
RESOURCE_NOT_FOUNDunknown endpoint_id, or an endpoint of another team.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:update.
retry_dead_webhook_deliveries
DESTRUCTIVEReplay every webhook delivery the team dead-lettered since an instant, once the consumer is fixed. Defaults to the last 24 hours.
The dashboard's Replay button. After a consumer outage, every row that ran out of retries sits in
the dead tab; this tool puts all of them since since back on the ladder in one call and answers
with how many it retried. Omit since for the last 24 hours, the window the dashboard uses.
Every replayed row posts its event again
Confirm the consumer is healthy first — a test with
test_webhook_endpoint is the cheap check
— or the same rows dead-letter a second time. Only dead-lettered rows are
touched; failed rows still on the ladder retry on their own.
since may not be in the future. Repeating the call after a successful replay retries nothing, because
the rows are no longer dead.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. It reaches beyond Subscriby: a connector, a provider or a member.
Arguments
sincestringoptionalISO 8601 instant; rows dead-lettered at or after it are replayed. Defaults to 24 hours ago.
What it returns
{ "data": { "retried": 17, "since": "2026-09-05T09:20:00+00:00" }}since echoes the instant actually used, so a call with no argument shows the 24-hour boundary it
applied.
How it fails
VALIDATION_FAILEDsince is malformed or in the future.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-delivery:retry.
retry_webhook_delivery
DESTRUCTIVEReplay one failed or dead-lettered webhook delivery from the start of the retry ladder. A pending or delivered row is refused.
Post the same event to the same endpoint again, once the consumer is fixed. The row goes back to
pending with its attempt count reset and walks the retry ladder from the start; the returned row is
that pending state.
Only failed or dead rows
A pending row is already going to be posted, and a delivered row already
was — replaying either would post the event twice, so both are refused with
VALIDATION_FAILED. Read the row first with
get_webhook_delivery if you are not sure.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. It reaches beyond Subscriby: a connector, a provider or a member.
Arguments
delivery_id*stringUUID of the failed or dead-lettered delivery to replay.
What it returns
{ "data": { "id": "34f1d78e-05a2-4b69-8c3d-7e921ab06f45", "endpoint_id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "event": "subscription.created", "event_id": "01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "status": "pending", "attempts": 0, "response_status": null, "response_excerpt": null, "payload": { "id": "evt_01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "type": "subscription.created", "created_at": "2026-09-06T10:05:00+00:00", "api_version": "2026-05-01", "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13", "data": { "subscription_id": "5b7e2d40-1a86-4c39-97f2-e83d0b16c5a4" } }, "next_attempt_at": "2026-09-06T10:40:00+00:00", "delivered_at": null, "dead_lettered_at": null, "created_at": "2026-09-06T10:05:00+00:00" }}How it fails
VALIDATION_FAILEDthe row is pending or delivered.
RESOURCE_NOT_FOUNDunknown delivery_id, or a delivery to another team's endpoint.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-delivery:retry.
rotate_webhook_endpoint_secret
DESTRUCTIVEReplace an endpoint's signing secret. The new secret is returned in this response only and the old one stops verifying at once.
Mint a new HMAC signing secret for an endpoint — because the old one leaked, because the consumer lost it, or on a rotation schedule. From this call on, every delivery to the endpoint is signed with the new secret and the previous one stops verifying.
Destructive, and the secret is returned once
Deliveries signed with the new secret start immediately, so a consumer still
checking the old one rejects everything until it is updated. Confirm the
endpoint_id with a human, have the new secret deployed straight from this
response, and never call it "to check" — every call mints another secret, and
none of them can be read back.
Only the creator who registered the endpoint, or the team owner, may rotate; a fellow team member is
refused with FORBIDDEN. Not idempotent.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it.
Arguments
endpoint_id*stringUUID of the webhook endpoint whose secret to replace.
What it returns
{ "data": { "id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "name": "CRM sync", "url": "https://hooks.example.com/subscriby", "project_id": null, "events": ["subscription.created", "subscription.cancelled"], "is_active": true, "disabled_at": null, "allowed_ips": [], "failure_count": 2, "consecutive_failures": 0, "last_success_at": "2026-09-05T18:00:00+00:00", "last_failure_at": "2026-08-30T07:12:00+00:00", "created_at": "2026-05-18T10:05:00+00:00", "secret": "whsec_..." }}How it fails
FORBIDDENthe token belongs to a team member who did not register the endpoint and is not the team owner.
VALIDATION_FAILEDthe rotation was refused for the endpoint's current state.
RESOURCE_NOT_FOUNDunknown endpoint_id, or an endpoint of another team.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:update.
test_webhook_endpoint
DESTRUCTIVEQueue a synthetic test event to an endpoint so its consumer can be checked end to end. Returns the queued delivery to poll.
Send an endpoint a signed test event without waiting for something real to happen. The answer is the
queued delivery in the get_webhook_delivery row shape, status
pending; poll that tool for the target's response_status and response_excerpt once the worker
has posted it.
Same worker, same signature, same ladder
The test delivery is posted by the same job that posts real events, signed
with the endpoint's current secret, and retried on the same ladder if the
target fails. A consumer that verifies the signature and returns 2xx for the
test will do so for real events.
Only the creator who registered the endpoint, or the team owner, may fire a test; a fellow team
member is refused with FORBIDDEN. REST rate-limits the same action to five per minute per
endpoint.
Requires ability
The token behind the MCP session must hold it, or the call is refused with TOKEN_MISSING_ABILITY.
Runs the same action as
The REST endpoint and this tool share one action, so validation, permissions and events are identical.
Annotations
A client that honours annotations asks a person before running it. It reaches beyond Subscriby: a connector, a provider or a member.
Arguments
endpoint_id*stringUUID of the webhook endpoint to send a test event to.
What it returns
{ "data": { "id": "34f1d78e-05a2-4b69-8c3d-7e921ab06f45", "endpoint_id": "c62a08f4-1b7d-4e35-9860-a37f5d21e0b9", "event": "webhook.test", "event_id": "01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "status": "pending", "attempts": 0, "response_status": null, "response_excerpt": null, "payload": { "id": "evt_01HXZ3Q8M7Y2K4N6P9R1T3V5W7", "type": "webhook.test", "created_at": "2026-09-06T09:20:00+00:00", "api_version": "2026-05-01", "project_id": null, "data": {} }, "next_attempt_at": null, "delivered_at": null, "dead_lettered_at": null, "created_at": "2026-09-06T09:20:00+00:00" }}How it fails
FORBIDDENthe token belongs to a team member who did not register the endpoint and is not the team owner.
VALIDATION_FAILEDthe test was refused for the endpoint's current state.
RESOURCE_NOT_FOUNDunknown endpoint_id, or an endpoint of another team.
AUTHENTICATION_REQUIREDno authenticated user on the request.
TOKEN_MISSING_ABILITYtoken lacks webhook-endpoint:update.
How is this guide?