List all webhook endpoints owned by the authenticated user. Returns slug, created_at, and request counts.

Create a callback endpoint and return its URL. Hand this URL to a long-running/async job (or another agent) as its webhook/callback target, then await the result with wait_for_callback. Also works as a plain webhook capture URL for any provider (Stripe, GitHub, …).

List callbacks received by an endpoint, newest first. Returns a summary (method, status, provider, received_at). Use get_callback_payload for the full body. Tip: read the newest received_at and pass it as after to wait_for_callback to wait only for what comes next.

Fetch a single received callback with full headers, decrypted body, and metadata. Use this to read the result of an async job after wait_for_callback or list_callbacks gives you a callback id.

Verify the HMAC signature of a received callback against the endpoint's configured secret (Stripe, GitHub, Shopify, or custom), using a timing-safe comparison. Returns whether the callback is authentic and untampered — call this before your agent acts on a payload. Requires the endpoint to have a webhook secret configured and a paid plan.

Replay a received callback to a target URL. The original headers and body are re-sent unchanged — useful to re-drive your handler against a known payload without re-triggering the upstream event.

Get details about a specific endpoint — its full URL, signature provider config, and custom response settings.

Block until the next webhook (callback) arrives at an endpoint, then return it — instead of polling. Use this for async/long-running work: kick off the job with the endpoint URL as its callback, then call wait_for_callback to receive the result the moment it lands (signature-verified, decrypted). Returns { status: 'received', request } on delivery, or { status: 'pending' } if timeoutMs elapses first (just call again to keep waiting). Pass after (the receivedAt of the last callback you saw) so a callback that arrived between calls is returned immediately rather than missed.