API
Webhook Configuration
Configure destination URLs, manage subscriptions, rotate signing secrets, and run tests.
Creating a Destination
In the Asiyst Developer Console under API → Webhooks, click Add Destination:
- Name: Give your destination a descriptive label (e.g.
Caszio Production Webhook).
- URL: Provide a publicly reachable HTTPS endpoint.
- Events: Select one or more events from the backend event registry.
- Copy Secret: Copy the one-time signing secret (
whsec_...) immediately. It is never displayed again.
HTTPS and SSRF Validation
To protect against Server-Side Request Forgery (SSRF):
- Non-HTTPS protocols (
http://,ftp://) are rejected.
- Private IP ranges (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16), loopback addresses (127.0.0.1,localhost), and cloud metadata endpoints (169.254.169.254,metadata.google.internal) are strictly blocked on both registration and runtime dispatch.
- Redirects are limited and revalidated at delivery time.
Rotating Signing Secrets
You can rotate a destination's signing secret anytime from the Console:
- Click the key icon on the destination card.
- Confirm rotation. A new secret is generated and displayed once.
- Update your server environment variables immediately.
Sending Test Events
Use the Test button to dispatch a synthetic event (webhook.test or selected event type). The dashboard records the attempt and displays latency, HTTP status code, and the response body excerpt in real time.