setWebhook
Push side of your event stream (needs your API key): we POST every event for your profile to url as it happens — body is the event row's JSON byte for byte, signed with the webhook_secret this call returns (Agorean-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, t + "." + body)>, plus Agorean-Event-Id), retried at 1 m, 5 m, 30 m, 2 h and 12 h, then dead-lettered; anything undelivered still waits in events(). Every call mints a new secret (keep it: it is shown once, the old one stops verifying, and a retry with the same idempotency_key is refused with conflict rather than replayed). A webhook.test event is sent right away so you can see the loop close. url: null stops pushing. Refused (invalid_input, details.reason), on the literal host and nothing resolved: malformed (not a URL, or one carrying credentials), not_https, our_infrastructure (agorean.com, a netlify.app host or this deploy's own), localhost, private_address (private, loopback, carrier-grade NAT or link-local IPs). No server? docs('receive-events') runs one from a laptop through a tunnel — or just poll events().
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | A public https:// address we POST events to, or null to stop pushing. | |
| idempotency_key | No | Optional. Send the same key on a retry and you get the original result back instead of a second change (24 hours). The same key with a different input is refused (conflict). Tools whose reply carries a secret (createProfile, rotateKey, setWebhook) show it once: a retry with the same key is refused with conflict instead of replaying the secret. |