Webhook - Qoder

Webhook is currently in Beta. APIs, fields, and behavior may change in future versions.

Webhook Endpoints store a receiver URL and subscribed events. When an event occurs, Qoder Cloud Agents sends a POST request to the Endpoint. Webhooks are suitable for asynchronous results such as Schedule Runs that cannot rely on a long-lived connection. These APIs manage only Endpoints created through Forward Mode in the current personal space or enterprise Workspace. Endpoints created in another space or mode are not listed and cannot be managed with these APIs.

APIs

Method	Path	Description
`POST`	`/api/v1/forward/webhook/endpoints`	Create an Endpoint
`GET`	`/api/v1/forward/webhook/endpoints`	List Endpoints
`GET`	`/api/v1/forward/webhook/endpoints/{endpoint_id}`	Get an Endpoint
`PUT`	`/api/v1/forward/webhook/endpoints/{endpoint_id}`	Update an Endpoint
`DELETE`	`/api/v1/forward/webhook/endpoints/{endpoint_id}`	Delete an Endpoint
`POST`	`/api/v1/forward/webhook/endpoints/{endpoint_id}/enable`	Enable an Endpoint
`POST`	`/api/v1/forward/webhook/endpoints/{endpoint_id}/disable`	Disable an Endpoint
`POST`	`/api/v1/forward/webhook/endpoints/{endpoint_id}/test`	Send a test event

Authentication

Webhook Endpoints are management resources. These APIs accept a Qoder PAT or an administrator Service Account Token:

Authorization: Bearer <PAT or administrator SAT>

Identity-level Service Account Tokens cannot manage Webhook Endpoints.

Public events

Forward currently supports the following 30 public events, matching the subscription catalog in the Forward console. The same Endpoint can subscribe to both Schedule business events and Managed Agents resource events. When you create or update an Endpoint, put the full event names from these tables into the events array.

Schedule and Schedule Run

Event type	Trigger
`forward.schedule.created`	A Schedule is created successfully.
`forward.schedule.archived`	A Schedule is archived successfully for the first time, including manual, batch, automatic, and cascaded archiving.
`forward.schedule_run.succeeded`	A Schedule Run completes successfully, with `data.status` set to `completed`.
`forward.schedule_run.failed`	A Schedule Run fails, with `data.status` set to `failed`.

The execution result of a Schedule Run differs from the channel push result. The channel push status is reported in data.push_status. The data of these four events includes the Schedule creation source. See Receive Webhook events for field descriptions and examples.

Session

Event type	Trigger
`session.status_run_started`	The Session starts a run.
`session.status_idled`	The Session becomes idle after the current run finishes or is canceled.
`session.status_terminated`	The Session is terminated.
`session.updated`	Session properties such as the title or metadata are updated.
`session.deleted`	The Session is deleted.

session.status_idled means the Session became idle. It does not mean the business run succeeded. Query the Session output and status to confirm the result.

Session Thread

Event type	Trigger
`session.thread_created`	A new thread is created in the Session.
`session.thread_idled`	The thread finishes its current run, is interrupted, or pauses to wait for an external action such as a tool result.
`session.thread_terminated`	The thread is terminated.

For thread events, data.id is the ID of the parent Session and data.session_thread_id identifies the specific thread. session.thread_idled does not necessarily mean the thread task is complete. While the thread waits for an external action, its status is blocked.

Agent

Event type	Trigger
`agent.created`	A Managed Agent is created successfully.
`agent.updated`	Managed Agent configuration is updated.
`agent.archived`	A Managed Agent is archived.
`agent.deleted`	A Managed Agent is deleted.

Agent here refers to the Managed Agents resource, not a Forward Template. These events do not indicate Template lifecycle changes.

Environment

Event type	Trigger
`environment.created`	An Environment is created successfully.
`environment.updated`	Environment configuration is updated.
`environment.archived`	An Environment is archived.
`environment.deleted`	An Environment is deleted.

Memory Store

Event type	Trigger
`memory_store.created`	A Memory Store is created successfully.
`memory_store.archived`	A Memory Store is archived.
`memory_store.deleted`	A Memory Store is deleted.

Vault and Vault Credential

Event type	Trigger
`vault.created`	A Vault is created successfully.
`vault.archived`	A Vault is archived.
`vault.deleted`	A Vault is deleted.
`vault_credential.created`	A Vault Credential is created successfully.
`vault_credential.archived`	A credential is archived, including cascaded archiving when its Vault is archived.
`vault_credential.deleted`	A credential is deleted, including cascaded deletion when its Vault is deleted.
`vault_credential.refresh_failed`	Refreshing an OAuth credential fails.

For credential events, data.id is the credential ID and data.vault_id is the ID of the parent Vault. These events do not contain credential secrets.

Subscription rules and test events

events must contain at least one item. It accepts full event names or the global wildcard *. Prefix wildcards such as forward.* or session.* are not supported.
* subscribes to all currently and subsequently deliverable events. In production, explicitly subscribe to the public events you need, and stay compatible with event types you do not yet recognize.
The API accepts any event name in namespace.name form, which does not mean the event is actually produced. Only the events in the public catalog above have a Forward delivery contract.
Forward does not publish Deployment or Deployment Run events. Do not treat every Managed Agents event as an event that Forward supports.
webhook.test is a targeted test event generated by the Send a test event API. It does not need to be in the subscription list and is not counted among the 30 business and resource events above.

For example, to receive both Session idle notifications and the final result of Schedule Runs:

{
  "events": [
    "session.status_idled",
    "forward.schedule_run.succeeded",
    "forward.schedule_run.failed"
  ]
}

See Receive Webhook events for event payloads, signature verification, and idempotency.

Workflow

Prepare a public HTTPS URL that accepts POST requests.
Create an Endpoint and securely store the signing_secret from the creation response.
Call the test API to verify connectivity and signature handling.
Subscribe to the required events and deduplicate deliveries by Webhook-ID.

Webhook delivery is at least once, so the same event may be delivered more than once. Return 2xx promptly, then process long-running work asynchronously.

​APIs

​Authentication

​Public events

​Schedule and Schedule Run

​Session

​Session Thread

​Agent

​Environment

​Memory Store

​Vault and Vault Credential

​Subscription rules and test events

​Workflow

APIs

Authentication

Public events

Schedule and Schedule Run

Session

Session Thread

Agent

Environment

Memory Store

Vault and Vault Credential

Subscription rules and test events

Workflow