Vacation Tracker Docs
REST API v2API referenceWebhooks

Send a test event

This API method queues a `webhook.test` event for the webhook and returns `202` with the ID of the delivery (`VT-Delivery-Id`). Requires `webhooks:write`. No request body. It does not create an operation: follow the result in the webhook's `lastDelivery`. - The test delivery is signed and sent with the same headers as any other event, makes a single attempt and is never retried. - It is sent to paused webhooks too; a `410 Gone` response pauses the webhook with `pausedReason: endpoint-gone`. - The `Idempotency-Key` and `X-On-Behalf-Of` headers are ignored. Errors: `403 FORBIDDEN` (the key owner no longer exists), `404 WEBHOOK_NOT_FOUND`, and `409 WEBHOOK_REVOKED` (the webhook is revoked).

POST
/v2/webhooks/{id}/test

Authorization

bearerAuth webhooks:write
AuthorizationBearer <token>

API key sent as Authorization: Bearer vt_live_<secret>. See the Authentication and Scopes sections at the top of this document for how keys are created, which scopes exist and how the key owner's role limits them.

In: header

Scope: webhooks:write

Path Parameters

id*string

webhook ID.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v2/webhooks/wh_3f1c2b9e-8a47-4d5e-9c61-2b7f0e4a1d93/test"
{
  "data": {
    "deliveryId": "dlv_1790157600000_8a47c61e2b7f4d5e9c613f1c2b9e1d93"
  }
}
{
  "error": {
    "code": "VALIDATION_ERROR",
    "name": "ValidationError",
    "description": "A query parameter, body field or header failed validation.",
    "resolution": "Fix the fields listed in details.fields and send the request again.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef",
    "details": {
      "fields": [
        {
          "path": "startDate",
          "message": "\"startDate\" is required"
        }
      ]
    }
  }
}
{
  "error": {
    "code": "UNAUTHORIZED",
    "name": "Unauthorized",
    "description": "The API key is missing, malformed or not recognized.",
    "resolution": "Send a valid API key in the Authorization header as Bearer followed by the full vt_live_ key.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}

{
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "name": "InsufficientScope",
    "description": "The API key does not have the scopes this request needs.",
    "resolution": "Add the scopes listed in details.requiredScopes to the key in the Vacation Tracker dashboard.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef",
    "details": {
      "requiredScopes": [
        "leaves:write"
      ]
    }
  }
}

{
  "error": {
    "code": "WEBHOOK_NOT_FOUND",
    "name": "Webhook not found",
    "description": "The webhook was not found.",
    "resolution": "Check the webhook ID.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "WEBHOOK_REVOKED",
    "name": "Webhook revoked",
    "description": "The webhook has been revoked.",
    "resolution": "Delete the webhook and create a new one.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "RATE_LIMITED",
    "name": "RateLimited",
    "description": "Too many requests were sent in a short time.",
    "resolution": "Wait a few seconds and retry, using the same Idempotency-Key for writes.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}
{
  "error": {
    "code": "INTERNAL_ERROR",
    "name": "InternalError",
    "description": "Something went wrong on our side.",
    "resolution": "Retry later, and if it keeps happening, contact Vacation Tracker support and quote the requestId.",
    "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef"
  }
}

Need help?

developers@vacationtracker.io

Delete a webhook

This API method deletes a webhook and returns `204`. Requires `webhooks:write`. No request body. No more deliveries are sent to it, including pending retries. A revoked webhook can be deleted. The `Idempotency-Key` and `X-On-Behalf-Of` headers are ignored. Errors: `403 FORBIDDEN` (the key owner no longer exists) and `404 WEBHOOK_NOT_FOUND`.

Rotate the signing secret

This API method creates a new signing secret and returns the webhook with `200` and the new `secret` (`whsec_...`). Requires `webhooks:write`. No request body. **The secret is shown only in this response**; store it securely. For the next 24 hours every delivery is signed with both the new and the previous secret (two `v1` entries in `VT-Signature`), so you can update your endpoint without missing deliveries. After that only the new secret is used. `secretPrefix` changes to the start of the new secret. The `Idempotency-Key` and `X-On-Behalf-Of` headers are ignored: a retried rotation creates another secret. Errors: `403 FORBIDDEN` (the key owner no longer exists), `404 WEBHOOK_NOT_FOUND`, and `409 WEBHOOK_REVOKED` (the webhook is revoked).