Custom Webhooks

Custom webhooks give you a public HTTPS endpoint that external systems (payment processors, CRMs, CI pipelines, form builders) can call to trigger a tool, agent, manager, or AutessaDB operation inside Autessa. This page covers managing webhook definitions — creating them, updating their configuration, rotating keys, sharing, and auditing deliveries — via the poweruser API.

This page manages webhook definitions. External systems call the webhook through the client-side execution endpoint (/clients/custom-webhooks?resourceId={webhookId}), which accepts any HTTP method and authenticates with the webhook's own wh: key. See the Custom Webhooks execution API for the trigger URL, payload format, and execution pipeline.

Base URL

https://api.autessa.com/autessa_poweruser/custom-webhooks

All management endpoints are POST with a JSON body. Authenticate with your poweruser key in the Authorization header (no Bearer prefix):

Authorization: pwrusr:{id}:{secret}

The webhook object

Every webhook returned by these endpoints has the same shape.

Name
id
Type
string
Description
Unique ID of the webhook. This is the resourceId external systems use in the trigger URL: https://api.autessa.com/clients/custom-webhooks?resourceId={id}.
Name
companyId
Type
string
Description
The company that owns the webhook.
Name
ownerId
Type
string
Description
The user who created the webhook. Only the owner can delete it.
Name
webhookConfig
Type
object
Description
The full webhook configuration. See The webhookConfig object below.
Name
apiKeyId
Type
string
Description
ID of the dedicated webhook API key. This matches the {keyId} segment of the webhook's wh:{keyId}:{keySecret} key. The secret itself is never returned here — only from /create and /refresh-api-key.
Name
isEnabled
Type
boolean
Description
Whether the webhook accepts deliveries. Disabled webhooks reject trigger requests.
Name
sharingLevel
Type
string
Description
Visibility of the webhook: PRIVATE, SPECIFIC_MEMBER, or COMPANY.
Name
companyPermissionLevel
Type
string
Description
Access level granted to everyone in the company when sharingLevel is COMPANY: READ, WRITE, PUBLISH, or ADMIN.
Name
createdAt
Type
string
Description
When the webhook was created, as an ISO-8601 UTC timestamp (e.g. 2026-06-30T18:22:41).
Name
updatedAt
Type
string
Description
When the webhook was last updated, as an ISO-8601 UTC timestamp.
Name
userAccessLevel
Type
string
Description
The calling user's effective access to this webhook: READ, WRITE, PUBLISH, or ADMIN.

The webhookConfig object

Name
name
Type
string
Description
Display name of the webhook. Required on create.
Name
description
Type
string
Description
What the webhook is for.
Name
validationConfig
Type
object
Description
Optional custom request validation. See validationConfig.
Name
payloadTransformConfig
Type
object
Description
How the incoming payload is turned into variables. See payloadTransformConfig.
Name
resourceExecutionConfig
Type
object
Description
Which resource runs when the webhook fires, and with what inputs. See resourceExecutionConfig.
Name
executionSettings
Type
object
Description
Timeout and retry behavior. See executionSettings.

validationConfig

Name
enableValidation
Type
boolean
Description
Whether to run the validation script on every delivery. Defaults to false.
Name
validationScript
Type
string
Description
AutessaScript that runs after key authentication. It receives headers, body, and queryParams as variables and must return a boolean — false rejects the delivery with 401. Use this to verify sender signatures (e.g. HMAC).

payloadTransformConfig

Name
transformType
Type
string
Description
JSONPATH (default) or AUTESSA_SCRIPT.
Name
jsonPathMappings
Type
object
Description
Map of variable name to JSONPath expression evaluated against the delivery body, e.g. {"orderId": "$.order.id"}. Used when transformType is JSONPATH.
Name
transformScript
Type
string
Description
AutessaScript for complex transformations. It receives payload (raw body string), headers, and queryParams as variables and must return a JSON object of variable mappings. Used when transformType is AUTESSA_SCRIPT.

The extracted variables are substituted into the handler's configured inputs wherever a @@{variableName} reference appears.

resourceExecutionConfig

Name
resourceType
Type
string
Description
Type of resource to execute: TOOL, AGENT, MANAGER, or AUTESSADB.
Name
resourceId
Type
string
Description
ID of the target tool, agent, or manager. Not used when resourceType is AUTESSADB — the target table is set in autessaDbConfig.targetTableId instead.
Name
variables
Type
object
Description
Tool input variables (TOOL only). Values support @@{variableName} references.
Name
environmentVariables
Type
object
Description
Environment variables for the execution (TOOL, AGENT, MANAGER). Values support @@{variableName} references.
Name
promptTemplateVariables
Type
object
Description
Prompt template variables (AGENT, MANAGER). Values support @@{variableName} references.
Name
privateVariables
Type
object
Description
Secret variables (TOOL). Not written to execution logs. Values support @@{variableName} references.
Name
userMessage
Type
string
Description
The user message sent to the agent or manager (AGENT, MANAGER). Supports @@{variableName} references.
Name
autessaDbConfig
Type
object
Description
Direct database operation configuration (AUTESSADB only). See autessaDbConfig.

autessaDbConfig

Name
operation
Type
string
Description
The database operation: INSERT, UPDATE, UPSERT, or DELETE.
Name
targetTableId
Type
string
Description
ID of the target AutessaDB table.
Name
values
Type
object
Description
Column values to insert or update. Map of column name to a typed column-value object (columnType plus the matching value field, e.g. textValue, integerValue, floatValue, booleanValue, multiSelectValue, filePath, or variableValue). Values support @@{variableName} references.
Name
recordId
Type
string
Description
For single-row updates: the specific record ID to update. Mutually exclusive with whereGroups. Supports @@{variableName} references.
Name
whereGroups
Type
array<object>
Description
For batch updates: WHERE condition groups matching the records to modify. Mutually exclusive with recordId.
Name
groupsLogicalOperator
Type
string
Description
Logical operator between WHERE groups: AND or OR. Only used with whereGroups.
Name
description
Type
string
Description
Optional description of what the operation does.

executionSettings

Name
timeoutSeconds
Type
integer
Description
Execution timeout in seconds. Defaults to 300.
Name
maxRetries
Type
integer
Description
Retry attempts on failure. Defaults to 3.
Name
retryDelaySeconds
Type
integer
Description
Delay between retries in seconds. Defaults to 5.

The webhook object
{
  "id": "V1StGXR8Z5",
  "companyId": "kTn4vB2p9Q",
  "ownerId": "aB3xK9mQ2w",
  "webhookConfig": {
    "name": "Order events",
    "description": "Handles order.created events from the storefront",
    "validationConfig": {
      "enableValidation": false
    },
    "payloadTransformConfig": {
      "transformType": "JSONPATH",
      "jsonPathMappings": {
        "orderId": "$.order.id",
        "eventType": "$.event.type"
      }
    },
    "resourceExecutionConfig": {
      "resourceType": "AGENT",
      "resourceId": "pQ7wXr2LmN",
      "userMessage": "Process order @@{orderId} for event @@{eventType}",
      "environmentVariables": {
        "SOURCE": "storefront"
      },
      "promptTemplateVariables": {}
    },
    "executionSettings": {
      "timeoutSeconds": 300,
      "maxRetries": 3,
      "retryDelaySeconds": 5
    }
  },
  "apiKeyId": "c1f2a3b4-5d6e-4789-9abc-0def12345678",
  "isEnabled": true,
  "sharingLevel": "PRIVATE",
  "companyPermissionLevel": null,
  "createdAt": "2026-06-30T18:22:41",
  "updatedAt": "2026-06-30T18:22:41",
  "userAccessLevel": "ADMIN"
}

Create Webhook POST`/create`

Creates a new webhook handler. The webhook is created enabled, and a dedicated webhook API key (named after the webhook) is generated for it. The response returns the full key value — wh:{keyId}:{keySecret} — once; only the key ID is stored retrievably, so save the key now. If you lose it, rotate it with /refresh-api-key.

The webhook's public trigger URL is derived from the returned id:

https://api.autessa.com/clients/custom-webhooks?resourceId={id}

The webhookConfig.name field is required; everything else in the configuration is optional and can be filled in later with /update.

Request Body

Name
webhookConfig
Type
object
Description
The webhook configuration. Must include name. See The webhookConfig object.

Response

Name
webhook
Type
object
Description
The created webhook. See The webhook object.
Name
apiKey
Type
string
Description
The full webhook API key (wh:{keyId}:{keySecret}). Returned only in this response — store it securely.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

cURL
JavaScript
Python

curl https://api.autessa.com/autessa_poweruser/custom-webhooks/create \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "webhookConfig": {
      "name": "Order events",
      "description": "Handles order.created events from the storefront",
      "payloadTransformConfig": {
        "transformType": "JSONPATH",
        "jsonPathMappings": {
          "orderId": "$.order.id",
          "eventType": "$.event.type"
        }
      },
      "resourceExecutionConfig": {
        "resourceType": "AGENT",
        "resourceId": "pQ7wXr2LmN",
        "userMessage": "Process order @@{orderId} for event @@{eventType}"
      }
    }
  }'

const response = await fetch(
  'https://api.autessa.com/autessa_poweruser/custom-webhooks/create',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': process.env.POWERUSER_KEY
    },
    body: JSON.stringify({
      webhookConfig: {
        name: 'Order events',
        description: 'Handles order.created events from the storefront',
        payloadTransformConfig: {
          transformType: 'JSONPATH',
          jsonPathMappings: {
            orderId: '$.order.id',
            eventType: '$.event.type'
          }
        },
        resourceExecutionConfig: {
          resourceType: 'AGENT',
          resourceId: 'pQ7wXr2LmN',
          userMessage: 'Process order @@{orderId} for event @@{eventType}'
        }
      }
    })
  }
);

const data = await response.json();
console.log(data.webhook.id, data.apiKey); // save the key!

import os
import requests

response = requests.post(
    'https://api.autessa.com/autessa_poweruser/custom-webhooks/create',
    headers={'Authorization': os.environ['POWERUSER_KEY']},
    json={
        'webhookConfig': {
            'name': 'Order events',
            'description': 'Handles order.created events from the storefront',
            'payloadTransformConfig': {
                'transformType': 'JSONPATH',
                'jsonPathMappings': {
                    'orderId': '$.order.id',
                    'eventType': '$.event.type'
                }
            },
            'resourceExecutionConfig': {
                'resourceType': 'AGENT',
                'resourceId': 'pQ7wXr2LmN',
                'userMessage': 'Process order @@{orderId} for event @@{eventType}'
            }
        }
    }
)

data = response.json()
print(data['webhook']['id'], data['apiKey'])  # save the key!

JSON
{
  "webhook": {
    "id": "V1StGXR8Z5",
    "companyId": "kTn4vB2p9Q",
    "ownerId": "aB3xK9mQ2w",
    "webhookConfig": {
      "name": "Order events",
      "description": "Handles order.created events from the storefront",
      "payloadTransformConfig": {
        "transformType": "JSONPATH",
        "jsonPathMappings": {
          "orderId": "$.order.id",
          "eventType": "$.event.type"
        }
      },
      "resourceExecutionConfig": {
        "resourceType": "AGENT",
        "resourceId": "pQ7wXr2LmN",
        "userMessage": "Process order @@{orderId} for event @@{eventType}"
      }
    },
    "apiKeyId": "c1f2a3b4-5d6e-4789-9abc-0def12345678",
    "isEnabled": true,
    "sharingLevel": "PRIVATE",
    "createdAt": "2026-06-30T18:22:41",
    "updatedAt": "2026-06-30T18:22:41",
    "userAccessLevel": "ADMIN"
  },
  "apiKey": "wh:c1f2a3b4-5d6e-4789-9abc-0def12345678:sk_9f8e7d6c5b4a"
}

Get Webhook POST`/get`

Fetches a single webhook by ID. Requires at least READ access to the webhook.

Request Body

Name
webhookId
Type
string
Description
ID of the webhook to fetch.

Response

Name
webhook
Type
object
Description
The webhook. See The webhook object.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

cURL
curl https://api.autessa.com/autessa_poweruser/custom-webhooks/get \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhookId": "V1StGXR8Z5"}'

JSON
{
  "webhook": {
    "id": "V1StGXR8Z5",
    "companyId": "kTn4vB2p9Q",
    "ownerId": "aB3xK9mQ2w",
    "webhookConfig": {
      "name": "Order events",
      "resourceExecutionConfig": {
        "resourceType": "AGENT",
        "resourceId": "pQ7wXr2LmN"
      }
    },
    "apiKeyId": "c1f2a3b4-5d6e-4789-9abc-0def12345678",
    "isEnabled": true,
    "sharingLevel": "PRIVATE",
    "createdAt": "2026-06-30T18:22:41",
    "updatedAt": "2026-06-30T18:22:41",
    "userAccessLevel": "ADMIN"
  }
}

List Webhooks POST`/get-all`

Lists every webhook the calling user can access in the current company — webhooks they own, webhooks shared with them directly, and company-shared webhooks.

Request Body

No fields — send an empty JSON object ({}).

Response

Name
webhooks
Type
array<object>
Description
All accessible webhooks. See The webhook object.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

cURL
curl https://api.autessa.com/autessa_poweruser/custom-webhooks/get-all \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

JSON
{
  "webhooks": [
    {
      "id": "V1StGXR8Z5",
      "companyId": "kTn4vB2p9Q",
      "ownerId": "aB3xK9mQ2w",
      "webhookConfig": {
        "name": "Order events"
      },
      "apiKeyId": "c1f2a3b4-5d6e-4789-9abc-0def12345678",
      "isEnabled": true,
      "sharingLevel": "COMPANY",
      "companyPermissionLevel": "READ",
      "createdAt": "2026-06-30T18:22:41",
      "updatedAt": "2026-06-30T18:22:41",
      "userAccessLevel": "ADMIN"
    }
  ]
}

Update Webhook POST`/update`

Updates a webhook's configuration and/or toggles it on or off. Requires WRITE access or higher — READ-only users are rejected.

The webhookConfig you send replaces the stored configuration, so send the complete config (fetch it with /get, modify, and send it back). If isEnabled is omitted, the current enabled state is kept.

Request Body

Name
webhookId
Type
string
Description
ID of the webhook to update.
Name
webhookConfig
Type
object
Description
The full replacement configuration. See The webhookConfig object.
Name
isEnabled
Type
boolean
Description
Set false to pause deliveries, true to resume. Unchanged if omitted.

Response

Name
webhook
Type
object
Description
The updated webhook. See The webhook object.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

cURL
curl https://api.autessa.com/autessa_poweruser/custom-webhooks/update \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "webhookId": "V1StGXR8Z5",
    "webhookConfig": {
      "name": "Order events",
      "description": "Now also handles refund events",
      "payloadTransformConfig": {
        "transformType": "JSONPATH",
        "jsonPathMappings": {
          "orderId": "$.order.id",
          "eventType": "$.event.type"
        }
      },
      "resourceExecutionConfig": {
        "resourceType": "AGENT",
        "resourceId": "pQ7wXr2LmN",
        "userMessage": "Process order @@{orderId} for event @@{eventType}"
      }
    },
    "isEnabled": true
  }'

JSON
{
  "webhook": {
    "id": "V1StGXR8Z5",
    "companyId": "kTn4vB2p9Q",
    "ownerId": "aB3xK9mQ2w",
    "webhookConfig": {
      "name": "Order events",
      "description": "Now also handles refund events"
    },
    "apiKeyId": "c1f2a3b4-5d6e-4789-9abc-0def12345678",
    "isEnabled": true,
    "sharingLevel": "PRIVATE",
    "createdAt": "2026-06-30T18:22:41",
    "updatedAt": "2026-07-01T09:15:03",
    "userAccessLevel": "ADMIN"
  }
}

Delete Webhook POST`/delete`

Permanently deletes a webhook. Only the webhook's owner can delete it — even ADMIN-level collaborators are rejected. External calls to the webhook's trigger URL stop working immediately.

Request Body

Name
webhookId
Type
string
Description
ID of the webhook to delete.

Response

Name
deleted
Type
boolean
Description
true if the webhook was deleted.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

cURL
curl https://api.autessa.com/autessa_poweruser/custom-webhooks/delete \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhookId": "V1StGXR8Z5"}'

JSON
{
  "deleted": true
}

Refresh API Key POST`/refresh-api-key`

Rotates the webhook's API key. The old key is invalidated immediately — any external system still sending it will start receiving 401 on the trigger URL — and a new full key value is generated and returned once in this response. Update the calling systems with the new key right away.

Requires ADMIN access to the webhook.

Request Body

Name
webhookId
Type
string
Description
ID of the webhook whose key to rotate.

Response

Name
apiKey
Type
string
Description
The new webhook API key (wh:{keyId}:{keySecret}). Returned only in this response — store it securely.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

cURL
curl https://api.autessa.com/autessa_poweruser/custom-webhooks/refresh-api-key \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhookId": "V1StGXR8Z5"}'

JSON
{
  "apiKey": "wh:c1f2a3b4-5d6e-4789-9abc-0def12345678:sk_2b3c4d5e6f7a"
}

Get Execution History POST`/get-execution-history`

Returns the paginated delivery log for a webhook — every trigger request that passed authentication, with its status, timing, and full execution details (request payload, transformed variables, and the handler's request/response). Requires at least READ access to the webhook.

Each entry's executionId matches the executionId returned to the caller by the execution endpoint, so you can correlate a specific delivery end to end.

Request Body

Name
webhookId
Type
string
Description
ID of the webhook whose history to fetch.
Name
status
Type
string
Description
Optional status filter: QUEUED, PROCESSING, SUCCESS, FAILED, or TRANSFORM_FAILED. Omit to return all statuses.
Name
page
Type
integer
Description
Zero-based page number. Defaults to 0.
Name
size
Type
integer
Description
Page size. Defaults to 20.

Response

Name
history
Type
array<object>
Description
Execution history entries, one per delivery attempt. See fields below.
Name
totalPages
Type
integer
Description
Total number of pages available.
Name
totalElements
Type
integer
Description
Total number of history entries matching the query.
Name
currentPage
Type
integer
Description
The zero-based page number returned.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

History entry fields

Name
id
Type
string
Description
Unique ID of the history record (a UUID string).
Name
executionId
Type
string
Description
Delivery correlation ID — the same value the execution endpoint returned to the external caller.
Name
webhookId
Type
string
Description
ID of the webhook that received the delivery.
Name
resourceType
Type
string
Description
Type of handler resource that ran: TOOL, AGENT, MANAGER, or AUTESSADB.
Name
resourceId
Type
string
Description
ID of the handler resource that ran.
Name
queuedAt
Type
string
Description
When the delivery was accepted and queued (ISO-8601 UTC timestamp).
Name
startedAt
Type
string
Description
When background execution started. Null while still queued.
Name
endedAt
Type
string
Description
When execution finished. Null until the run completes.
Name
durationMs
Type
integer
Description
Execution duration in milliseconds.
Name
status
Type
string
Description
Current status of the delivery: QUEUED, PROCESSING, SUCCESS, FAILED, or TRANSFORM_FAILED.
Name
attemptNumber
Type
integer
Description
Which retry attempt this entry represents (1 for the first attempt).
Name
executionDetails
Type
object
Description
Full delivery detail. See fields below.

executionDetails fields

Name
webhookName
Type
string
Description
Name of the webhook at the time of delivery.
Name
httpMethod
Type
string
Description
HTTP method the external system used (GET, POST, PUT, DELETE, PATCH).
Name
sourceIp
Type
string
Description
IP address the delivery came from.
Name
requestHeaders
Type
string
Description
The delivery's HTTP headers, JSON-encoded.
Name
requestPayload
Type
string
Description
The raw request body as received.
Name
transformType
Type
string
Description
Transform that was applied: JSONPATH or AUTESSA_SCRIPT.
Name
transformedVariables
Type
string
Description
The variables extracted from the payload, JSON-encoded.
Name
transformError
Type
string
Description
Error message if the payload transform failed. Null otherwise.
Name
resourceRequestJson
Type
string
Description
The request sent to the handler resource, JSON-encoded.
Name
resourceResponseJson
Type
string
Description
The handler resource's response, JSON-encoded.
Name
errorMessage
Type
string
Description
Error message if execution failed. Null otherwise.

cURL
JavaScript
Python

curl https://api.autessa.com/autessa_poweruser/custom-webhooks/get-execution-history \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "webhookId": "V1StGXR8Z5",
    "status": "FAILED",
    "page": 0,
    "size": 20
  }'

const response = await fetch(
  'https://api.autessa.com/autessa_poweruser/custom-webhooks/get-execution-history',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': process.env.POWERUSER_KEY
    },
    body: JSON.stringify({
      webhookId: 'V1StGXR8Z5',
      status: 'FAILED',
      page: 0,
      size: 20
    })
  }
);

const data = await response.json();
for (const entry of data.history) {
  console.log(entry.executionId, entry.status, entry.durationMs);
}

import os
import requests

response = requests.post(
    'https://api.autessa.com/autessa_poweruser/custom-webhooks/get-execution-history',
    headers={'Authorization': os.environ['POWERUSER_KEY']},
    json={
        'webhookId': 'V1StGXR8Z5',
        'status': 'FAILED',
        'page': 0,
        'size': 20
    }
)

data = response.json()
for entry in data['history']:
    print(entry['executionId'], entry['status'], entry['durationMs'])

JSON
{
  "history": [
    {
      "id": "7d0a4c2e-91f3-4b6a-8c5d-1e2f3a4b5c6d",
      "executionId": "exec_f47ac10b58cc",
      "webhookId": "V1StGXR8Z5",
      "resourceType": "AGENT",
      "resourceId": "pQ7wXr2LmN",
      "queuedAt": "2026-07-01T08:30:12",
      "startedAt": "2026-07-01T08:30:13",
      "endedAt": "2026-07-01T08:30:19",
      "durationMs": 6114,
      "status": "FAILED",
      "attemptNumber": 1,
      "executionDetails": {
        "webhookName": "Order events",
        "httpMethod": "POST",
        "sourceIp": "203.0.113.42",
        "requestHeaders": "{\"content-type\": \"application/json\"}",
        "requestPayload": "{\"order\": {\"id\": \"ord_991\"}, \"event\": {\"type\": \"order.created\"}}",
        "transformType": "JSONPATH",
        "transformedVariables": "{\"orderId\": \"ord_991\", \"eventType\": \"order.created\"}",
        "transformError": null,
        "resourceRequestJson": "{\"agentId\": \"pQ7wXr2LmN\", \"input\": [...]}",
        "resourceResponseJson": null,
        "errorMessage": "Agent execution timed out after 300 seconds"
      }
    }
  ],
  "totalPages": 3,
  "totalElements": 47,
  "currentPage": 0
}

Changes who can see and manage a webhook. Requires ADMIN access, and the webhook must belong to your current company.

Sharing has three levels:

PRIVATE — only the owner (and existing direct shares) can access it.
COMPANY — everyone in the company gets the access level in accessLevel.
SPECIFIC_MEMBER — the users in usersToAdd get their individual access levels.

Request Body

Name
webhookId
Type
string
Description
ID of the webhook to share.
Name
level
Type
string
Description
Sharing level: PRIVATE, COMPANY, or SPECIFIC_MEMBER.
Name
accessLevel
Type
string
Description
Access level granted company-wide: READ, WRITE, PUBLISH, or ADMIN. Required when level is COMPANY.
Name
usersToAdd
Type
array<object>
Description
Users to grant access to. Required when level is SPECIFIC_MEMBER. Each entry has userEmail (string), userId (string), and accessLevel (string).
Name
usersToRemove
Type
array<object>
Description
Users to drop from access when editing an existing share. Same entry shape as usersToAdd.

Response

Name
updated
Type
boolean
Description
true if the sharing settings were saved.
Name
errors
Type
array<string>
Description
Array of error messages. Absent on success.

cURL
curl https://api.autessa.com/autessa_poweruser/custom-webhooks/share \
  -H "Authorization: $POWERUSER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "webhookId": "V1StGXR8Z5",
    "level": "SPECIFIC_MEMBER",
    "usersToAdd": [
      {
        "userEmail": "teammate@example.com",
        "userId": "mK4rT8vZ1x",
        "accessLevel": "WRITE"
      }
    ]
  }'

JSON
{
  "updated": true
}

Errors

All endpoints return errors in a consistent shape. Exceptions are caught server-side and folded into the errors array of the response — when errors is present, the HTTP status is non-2xx.

Name
errors
Type
array<string>
Description
Human-readable error messages, e.g. "Webhook not found", "Webhook must have a name in the configuration", "Only the owner can delete this webhook", "Only admins can refresh the API key".

Common failure cases:

401 — missing or invalid poweruser key, or the key lacks access to the target webhook (not-found and permission failures are both reported this way).
Validation failures — missing webhookConfig, or a config without a name on create.
Permission failures — READ-only users calling /update; non-owners calling /delete; non-ADMIN users calling /refresh-api-key or /share.

Poweruser API overview
Custom Webhooks execution API — the public trigger endpoint external systems call
Poweruser Agents API
Poweruser Tools API
Poweruser AutessaDB Tables API

Base URL​

The webhook object​

The webhookConfig object​

validationConfig​

payloadTransformConfig​

resourceExecutionConfig​

autessaDbConfig​

executionSettings​

Create Webhook POST/create​

Request Body​

Response​

Get Webhook POST/get​

Request Body​

Response​

List Webhooks POST/get-all​

Request Body​

Response​

Update Webhook POST/update​

Request Body​

Response​

Delete Webhook POST/delete​

Request Body​

Response​

Refresh API Key POST/refresh-api-key​

Request Body​

Response​

Get Execution History POST/get-execution-history​

Request Body​

Response​

History entry fields​

executionDetails fields​

Share Webhook POST/share​

Request Body​

Response​

Errors​

Related​

Base URL

The webhook object

The webhookConfig object

validationConfig

payloadTransformConfig

resourceExecutionConfig

autessaDbConfig

executionSettings

Create Webhook POST`/create`

Request Body

Response

Get Webhook POST`/get`

Request Body

Response

List Webhooks POST`/get-all`

Request Body

Response

Update Webhook POST`/update`

Request Body

Response

Delete Webhook POST`/delete`

Request Body

Response

Refresh API Key POST`/refresh-api-key`

Request Body

Response

Get Execution History POST`/get-execution-history`

Request Body

Response

History entry fields

executionDetails fields

Share Webhook POST`/share`

Request Body

Response

Errors

Related