curl --request POST \
--url https://compute.x402layer.cc/pods/v1/webhooks \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"url": "<string>",
"event_types": []
}
'import requests
url = "https://compute.x402layer.cc/pods/v1/webhooks"
payload = {
"url": "<string>",
"event_types": []
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({url: '<string>', event_types: []})
};
fetch('https://compute.x402layer.cc/pods/v1/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://compute.x402layer.cc/pods/v1/webhooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => '<string>',
'event_types' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://compute.x402layer.cc/pods/v1/webhooks"
payload := strings.NewReader("{\n \"url\": \"<string>\",\n \"event_types\": []\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://compute.x402layer.cc/pods/v1/webhooks")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"url\": \"<string>\",\n \"event_types\": []\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://compute.x402layer.cc/pods/v1/webhooks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"url\": \"<string>\",\n \"event_types\": []\n}"
response = http.request(request)
puts response.read_body{
"webhook": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"url": "<string>",
"event_types": [
"pod.created"
],
"enabled": true,
"disabled_by_us_at": "2023-11-07T05:31:56Z",
"failure_count": 123,
"last_error": "<string>",
"last_delivery_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"secret": "<string>",
"secret_note": "<string>"
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}Create a webhook
Base URL https://compute.x402layer.cc/pods/v1. Auth is X-API-Key only. This is the PROGRAMMATIC surface and is NOT the same as the dashboard pod routes (POST /pods, PATCH /pods/{id}/settings, …), which take a wallet signature or a browser session and are free to change. Every response carries x-request-id.
HTTPS only. The signing secret is returned once and never again - an endpoint secret that can be fetched is one an attacker with read access can forge deliveries with. If you lose it, rotate the endpoint.
Omit event_types to receive everything. An EMPTY array is refused, because a subscription to nothing is a webhook that silently never fires.
Limit: 10 webhooks per account.
Verify every delivery against the RAW body. Deliveries carry:
x-sgl-signature: t=<unix>,v1=<hmac-sha256 of "<t>.<raw body>">
x-sgl-event-type: pod.status.changed
x-sgl-event-id: <uuid>
Parsing and re-encoding JSON changes key order and spacing, and the signature covers the bytes we sent - re-serialise and a genuine delivery fails to verify. Both SDKs ship a helper (verifyPodWebhook, verify_pod_webhook) that also enforces a 300-second timestamp window. The window is not optional: the timestamp is inside the signed string precisely so a captured delivery cannot be replayed later, and without a window an old capture still verifies.
Failed deliveries back off at 1, 5, 15, 60, 180, 360 and 720 minutes, then stop. When we give up, disabled_by_us_at is set - deliberately distinct from enabled: false, which is you turning it off. From the outside both look like silence.
Rate limit: the shared write bucket, 60 requests/minute per account.
curl --request POST \
--url https://compute.x402layer.cc/pods/v1/webhooks \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"url": "<string>",
"event_types": []
}
'import requests
url = "https://compute.x402layer.cc/pods/v1/webhooks"
payload = {
"url": "<string>",
"event_types": []
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({url: '<string>', event_types: []})
};
fetch('https://compute.x402layer.cc/pods/v1/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://compute.x402layer.cc/pods/v1/webhooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => '<string>',
'event_types' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://compute.x402layer.cc/pods/v1/webhooks"
payload := strings.NewReader("{\n \"url\": \"<string>\",\n \"event_types\": []\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://compute.x402layer.cc/pods/v1/webhooks")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"url\": \"<string>\",\n \"event_types\": []\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://compute.x402layer.cc/pods/v1/webhooks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"url\": \"<string>\",\n \"event_types\": []\n}"
response = http.request(request)
puts response.read_body{
"webhook": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"url": "<string>",
"event_types": [
"pod.created"
],
"enabled": true,
"disabled_by_us_at": "2023-11-07T05:31:56Z",
"failure_count": 123,
"last_error": "<string>",
"last_delivery_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"secret": "<string>",
"secret_note": "<string>"
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}Authorizations
A compute API key (x402c_...). Mint one in the dashboard under Settings -> API Keys. This is the ONLY auth /pods/v1/* accepts - wallet signatures are bound to method+path+body and do not survive the internal hop, so signature callers must use the dashboard routes instead. Two extra scopes gate the dangerous powers: pods:wallet:write (pod wallet money, backup passphrase) and pods:control:write (connectors, full-power control socket).
Body
HTTPS only. Credentials in the URL, localhost, .internal/.local hosts and private IP literals are refused.
Omit for every event. An empty array is refused.
pod.created, pod.active, pod.destroyed, pod.destroy_failed, pod.action.queued, pod.status.changed, pod.renewed, pod.renewal_failed, pod.expiring, pod.backup.completed, pod.backup.failed Response
Webhook created. secret is shown once.
Show child attributes
Show child attributes
Was this page helpful?
