1. Docs
  2. Reference
  3. REST API Docs
  4. Webhooks

Webhooks

    The Webhooks API allows you to create and manage webhooks for organizations and stacks. Webhooks notify external services of events happening within your Pulumi organization, such as stack updates, deployments, or policy violations.

    List Organization Webhooks

    GET /api/orgs/{orgName}/hooks

    Returns all webhooks configured at the organization level. Each webhook in the response includes its name, destination URL, format (generic JSON, Slack, or Microsoft Teams), active status, and subscribed event filters. Organization-level webhooks can fire on stack lifecycle events, deployment events, drift detection events, and policy violation events.

    Request Parameters

    • orgName string path required
      The organization name

    Responses

    200 successful operation

    Create Organization Webhook

    POST /api/orgs/{orgName}/hooks

    Creates a new webhook for an organization to notify external services when events occur. Webhooks can be configured to fire on stack events (created, deleted, update succeeded/failed), deployment events (queued, started, succeeded, failed), drift detection events, and policy violation events (mandatory, advisory).

    The format field accepts: raw (default), slack, ms_teams, or pulumi_deployments.

    The filters field accepts a list of event types to subscribe to. See the webhook event filtering documentation for available filters.

    The optional secret field sets the HMAC key for signature verification via the Pulumi-Webhook-Signature header. See the webhook headers documentation for details.

    Request Parameters

    • orgName string path required
      The organization name

    Request Body

    Schema: Webhook
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).

    Responses

    201 Created
    • hasSecret boolean required
      HasSecret is true if the webhook has a secret. This is used to determine whether to show that there is a secret in the UI.
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • secretCiphertext string required
      SecretCiphertext is the ciphertext value of the webhook’s secret. It’s used to check whether the secret was changed by the PSP
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).
    Errors: 400 Organization name from request body doesn't match URL. 409 Webhook with this name already exists

    Get Organization Webhook

    GET /api/orgs/{orgName}/hooks/{hookName}

    Returns the configuration of a specific organization-level webhook, including its name, destination URL, format (generic JSON, Slack, or Microsoft Teams), active status, event filter subscriptions, and whether a shared secret is configured for HMAC signature verification.

    Request Parameters

    • orgName string path required
      The organization name
    • hookName string path required
      The webhook name identifier

    Responses

    200 OK
    • hasSecret boolean required
      HasSecret is true if the webhook has a secret. This is used to determine whether to show that there is a secret in the UI.
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • secretCiphertext string required
      SecretCiphertext is the ciphertext value of the webhook’s secret. It’s used to check whether the secret was changed by the PSP
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).
    Errors: 404 Webhook

    Update Organization Webhook

    PATCH /api/orgs/{orgName}/hooks/{hookName}

    Updates an existing organization-level webhook’s configuration, including its destination URL, format, active status, event filter subscriptions, and shared secret. The ‘pulumi_deployments’ format can only be used on stack or environment webhooks, not organization-level ones.

    Request Parameters

    • orgName string path required
      The organization name
    • hookName string path required
      The webhook name identifier

    Request Body

    Schema: Webhook
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).

    Responses

    200 OK
    • hasSecret boolean required
      HasSecret is true if the webhook has a secret. This is used to determine whether to show that there is a secret in the UI.
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • secretCiphertext string required
      SecretCiphertext is the ciphertext value of the webhook’s secret. It’s used to check whether the secret was changed by the PSP
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).
    Errors: 400 'pulumi_deployments' format can only be used on stack or environment webhooks. 404 Webhook

    Delete Organization Webhook

    DELETE /api/orgs/{orgName}/hooks/{hookName}

    Permanently deletes an organization-level webhook. The webhook will no longer receive event notifications for stack updates, deployments, drift detection, or policy violations. This action cannot be undone.

    Request Parameters

    • orgName string path required
      The organization name
    • hookName string path required
      The webhook name identifier

    Responses

    204 No Content

    Get Organization Webhook Deliveries

    GET /api/orgs/{orgName}/hooks/{hookName}/deliveries

    Returns the recent delivery history for a specific webhook, including the HTTP status code, response time, request payload, and delivery timestamp for each attempt. This allows monitoring webhook health and diagnosing delivery failures. Each delivery includes a unique Pulumi-Webhook-ID.

    Request Parameters

    • orgName string path required
      The organization name
    • hookName string path required
      The webhook name identifier

    Responses

    200 successful operation

    Redeliver Organization Webhook Event

    POST /api/orgs/{orgName}/hooks/{hookName}/deliveries/{event}/redeliver

    Triggers the Pulumi Service to redeliver a specific event to a webhook. For example, to resend an event that the hook failed to process the first time.

    Request Parameters

    • orgName string path required
      The organization name
    • hookName string path required
      The webhook name identifier
    • event string path required
      The event identifier to redeliver

    Responses

    200 OK
    • id string required
      The unique identifier of the delivery.
    • kind string required
      The kind of webhook event.
    • payload string required
      The JSON payload that was sent.
    • timestamp integer required
      The time the delivery was sent, as a Unix epoch timestamp.
    • duration integer required
      The duration of the delivery request in milliseconds.
    • requestUrl string required
      The URL the webhook was delivered to.
    • requestHeaders string required
      The HTTP headers sent with the request.
    • responseCode integer required
      The HTTP response status code.
    • responseHeaders string required
      The HTTP response headers.
    • responseBody string required
      The HTTP response body.
    Errors: 404 Webhook

    Ping Organization Webhook

    POST /api/orgs/{orgName}/hooks/{hookName}/ping

    Sends a test ping to an organization webhook to validate that it is working. This function bypasses the message queue machinery and issues the request directly to the webhook.

    Request Parameters

    • orgName string path required
      The organization name
    • hookName string path required
      The webhook name identifier

    Responses

    200 OK
    • id string required
      The unique identifier of the delivery.
    • kind string required
      The kind of webhook event.
    • payload string required
      The JSON payload that was sent.
    • timestamp integer required
      The time the delivery was sent, as a Unix epoch timestamp.
    • duration integer required
      The duration of the delivery request in milliseconds.
    • requestUrl string required
      The URL the webhook was delivered to.
    • requestHeaders string required
      The HTTP headers sent with the request.
    • responseCode integer required
      The HTTP response status code.
    • responseHeaders string required
      The HTTP response headers.
    • responseBody string required
      The HTTP response body.
    Errors: 404 Webhook

    List Stack Webhooks

    GET /api/stacks/{orgName}/{projectName}/{stackName}/hooks

    Returns all webhooks configured for the specified stack. Each webhook in the response includes its name, display name, payload URL, format, filters, and active status.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name

    Responses

    200 successful operation

    Create Stack Webhook

    POST /api/stacks/{orgName}/{projectName}/{stackName}/hooks

    Creates a new webhook for the specified stack. The request body must include the webhook name, payload URL, and format.

    The format field accepts: raw (default), slack, ms_teams, or pulumi_deployments.

    The filters field accepts a list of event types to subscribe to. See the webhook event filtering documentation for available filters.

    The optional secret field sets the HMAC key for signature verification. See the webhook headers documentation for details.

    Returns 409 if a webhook with the same name already exists. Returns 400 if the organization or stack name in the request body does not match the URL path parameters.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name

    Request Body

    Schema: Webhook
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).

    Responses

    201 Created
    • hasSecret boolean required
      HasSecret is true if the webhook has a secret. This is used to determine whether to show that there is a secret in the UI.
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • secretCiphertext string required
      SecretCiphertext is the ciphertext value of the webhook’s secret. It’s used to check whether the secret was changed by the PSP
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).
    Errors: 400 Organization name from request body doesn't match URL or Stack name from request body doesn't match URL or invalid webhook name, display name, format, payload URL, groups, or filters. 409 Webhook with name {name} already exists.

    Get Stack Webhook

    GET /api/stacks/{orgName}/{projectName}/{stackName}/hooks/{hookName}

    Returns the details of a single webhook identified by its name, including its configuration, filters, groups, and active status. Returns 404 if the webhook does not exist.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name
    • hookName string path required
      The webhook name

    Responses

    200 OK
    • hasSecret boolean required
      HasSecret is true if the webhook has a secret. This is used to determine whether to show that there is a secret in the UI.
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • secretCiphertext string required
      SecretCiphertext is the ciphertext value of the webhook’s secret. It’s used to check whether the secret was changed by the PSP
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).
    Errors: 404 Webhook

    Update Stack Webhook

    PATCH /api/stacks/{orgName}/{projectName}/{stackName}/hooks/{hookName}

    Updates an existing webhook’s configuration. Supports modifying the display name, payload URL, format, groups, filters, and active status. The ‘pulumi_deployments’ format can only be used on stack or environment webhooks. Returns 404 if the webhook does not exist.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name
    • hookName string path required
      The webhook name

    Request Body

    Schema: Webhook
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).

    Responses

    200 OK
    • hasSecret boolean required
      HasSecret is true if the webhook has a secret. This is used to determine whether to show that there is a secret in the UI.
    • organizationName string required
      The organization that owns this webhook.
    • projectName string optional
      The project name. Set when the webhook is scoped to a specific stack.
    • secretCiphertext string required
      SecretCiphertext is the ciphertext value of the webhook’s secret. It’s used to check whether the secret was changed by the PSP
    • stackName string optional
      The stack name. Set when the webhook is scoped to a specific stack.
    • envName string optional
      The environment name. Set when the webhook is scoped to a specific environment.
    • name string required
      The unique identifier name for the webhook within its scope.
    • displayName string required
      The human-readable display name shown in the UI.
    • payloadUrl string required
      The URL to which webhook payloads are delivered.
    • secret string optional
      Secret will be omitted when returned from the service.
    • active boolean required
      Whether the webhook is active and will receive deliveries.
    • format string optional
      The format of the webhook payload (e.g., ‘raw’, ‘slack’, ‘ms_teams’).
    • filters array[string] optional
      Specific event types this webhook subscribes to. If empty, all events are delivered.
    • groups array[string] optional
      Event groups this webhook subscribes to (e.g., ‘stacks’, ‘deployments’).
    Errors: 400 'pulumi_deployments' format can only be used on stack or environment webhooks or Invalid display name, format, payload URL, groups, or filters. 404 Webhook

    Delete Stack Webhook

    DELETE /api/stacks/{orgName}/{projectName}/{stackName}/hooks/{hookName}

    Deletes a webhook from the specified stack. Returns 204 with no content on success.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name
    • hookName string path required
      The webhook name

    Responses

    204 No Content

    Get Stack Webhook Deliveries

    GET /api/stacks/{orgName}/{projectName}/{stackName}/hooks/{hookName}/deliveries

    Returns the recent delivery history for a specific webhook. Each delivery includes the timestamp, HTTP status code, request and response details, and whether the delivery was successful.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name
    • hookName string path required
      The webhook name

    Responses

    200 successful operation

    Redeliver Stack Webhook Event

    POST /api/stacks/{orgName}/{projectName}/{stackName}/hooks/{hookName}/deliveries/{event}/redeliver

    Triggers the Pulumi Service to redeliver a specific event to a webhook. This is useful for resending an event that the webhook endpoint failed to process on the initial delivery attempt. Returns the delivery result with HTTP status and response details. Returns 404 if the webhook or event does not exist.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name
    • hookName string path required
      The webhook name
    • event string path required
      The webhook delivery event identifier to redeliver

    Responses

    200 OK
    • id string required
      The unique identifier of the delivery.
    • kind string required
      The kind of webhook event.
    • payload string required
      The JSON payload that was sent.
    • timestamp integer required
      The time the delivery was sent, as a Unix epoch timestamp.
    • duration integer required
      The duration of the delivery request in milliseconds.
    • requestUrl string required
      The URL the webhook was delivered to.
    • requestHeaders string required
      The HTTP headers sent with the request.
    • responseCode integer required
      The HTTP response status code.
    • responseHeaders string required
      The HTTP response headers.
    • responseBody string required
      The HTTP response body.
    Errors: 404 Webhook or WebhookEvent

    Ping Stack Webhook

    POST /api/stacks/{orgName}/{projectName}/{stackName}/hooks/{hookName}/ping

    Issues a test ping event to the specified webhook to verify it is properly configured and reachable. Unlike normal webhook deliveries, this bypasses the message queue and sends the request directly to the webhook endpoint. The response includes the delivery result with HTTP status and response details. Returns 404 if the webhook does not exist.

    Request Parameters

    • orgName string path required
      The organization name
    • projectName string path required
      The project name
    • stackName string path required
      The stack name
    • hookName string path required
      The webhook name

    Responses

    200 OK
    • id string required
      The unique identifier of the delivery.
    • kind string required
      The kind of webhook event.
    • payload string required
      The JSON payload that was sent.
    • timestamp integer required
      The time the delivery was sent, as a Unix epoch timestamp.
    • duration integer required
      The duration of the delivery request in milliseconds.
    • requestUrl string required
      The URL the webhook was delivered to.
    • requestHeaders string required
      The HTTP headers sent with the request.
    • responseCode integer required
      The HTTP response status code.
    • responseHeaders string required
      The HTTP response headers.
    • responseBody string required
      The HTTP response body.
    Errors: 404 Webhook