GunSpec

My Webhooks

Register HTTPS endpoints to be told when GunSpec data changes, instead of polling for it. Subscribe to events such as firearm.created or firearm.updated and the changed record is delivered to your server in the same shape the API returns it, so a local mirror can be kept current without a second call. Requires Studio tier or higher.

Auth RequiredExplorer+

Create Webhook Endpoint

Registers an HTTPS endpoint to receive event deliveries. The response includes a signing secret; it is shown once and cannot be retrieved later.

POST/v1/me/webhooks

Explorer+

  • stringheaderrequired

    Your API key. Authorization: Bearer <key> is accepted in its place.

application/json

  • stringrequired

    Where deliveries are POSTed. A public https hostname on port 443: no IP address, no credentials in the URL, and not a gunspec.io or workers.dev host. Redirects are not followed, so register the final URL. At most 2,048 characters.

  • string[]required

    Event types this endpoint is subscribed to. The full list is on the POST operation.

  • string

    Prose summary of the record, where one has been written.

application/json

  • WebhookEndpointCreated

    The response payload

  • string

    Opaque endpoint id. Address it at /v1/me/webhooks/{endpointId}.

  • string

    Absolute, directly fetchable URL.

  • string[]

    Event types this endpoint is subscribed to. The full list is on the POST operation.

  • string | null

    Prose summary of the record, where one has been written.

  • boolean

    False while the endpoint is paused. A paused endpoint receives nothing and is not retried.

  • string

    When the record was first added, YYYY-MM-DD HH:MM:SS in UTC.

  • string

    When the endpoint was last changed, ISO 8601.

  • string

    HMAC signing secret. Returned only here, on creation. No other endpoint will show it again.

  • 400VALIDATION_ERRORValidation error
  • 401UNAUTHORIZEDAPI key required
  • 403FORBIDDENValid key, not permitted
  • 413PAYLOAD_TOO_LARGERequest body too large
  • 429RATE_LIMITEDRate limit exceeded
  • 500INTERNAL_ERRORUnexpected server error

Requires Studio tier or higher.

The URL must be HTTPS. Plain HTTP URLs are rejected.

Supported events: firearm.created, firearm.updated, firearm.deleted, firearm.variant.updated, firearm.source.changed, firearm.confidence.changed, manufacturer.created, manufacturer.updated, manufacturer.deleted, caliber.created, caliber.updated, caliber.deleted, category.created, category.updated, category.deleted, image.created, image.deleted and catalog.resynced.

firearm.variant.updated carries the same payload as firearm.updated and is sent only for records that have a parent, so a family can be tracked without taking the whole catalog's traffic. firearm.source.changed and firearm.confidence.changed say which kind of change it was and arrive alongside firearm.updated.

catalog.resynced replaces a flood: when more records change at once than can be described individually, such as a re-derivation of the whole catalog, one event is sent instead of thousands, and the right response is to re-sync rather than to apply per-record updates. It reaches every endpoint subscribed to any event, ticked or not.

Catalog events carry the record in the same shape GET /v1/firearms/{id} returns it, version included, so a cache can be updated without a second call. A deletion carries the id alone.

Deliveries also carry X-Webhook-Id (the event, stable across retries, so dedupe on it), X-Webhook-Event, and X-Webhook-Delivery (this attempt). A non-2xx response is retried three times, 1, 5 and 15 minutes apart.

The secret is shown only in this create response. It cannot be retrieved later, so store it immediately. Delete and recreate the endpoint to rotate it.

Verify deliveries with the X-Webhook-Signature header. See the Verifying deliveries note on the Test endpoint for the exact scheme.

Full rate limits

Minimum tier
Explorer+
Monthly quota
200/mo
Rate limit
10/min
Daily cap
50

Figures shown are for this endpoint's minimum tier. Higher tiers raise every limit.