Webhooks

Endpoints that receive notifications of an organization's events

Endpoints

GET/webhooksPOST/webhooksDELETE/webhooksPATCH/webhooks

The webhook object

Attributes

iduuid

Unique identifier

grant_iduuid | null

oauth_grants.id

Identifier of the OAuth grant that created the webhook. Revoking the grant, or its access to the organization, disables the webhook

organization_iduuid

organizations.id

Identifier of the related organization

created_attimestamp with time zone

Creation timestamp

updated_attimestamp with time zone

Last modification timestamp

descriptiontext

Description of the webhook, if any

disabled_attimestamp with time zone | null

When the webhook was disabled, because its endpoint kept failing or the OAuth grant that created it lost access. A disabled webhook gets no notifications; set this to null to enable it again

endpointtext

URL notifications are sent to

eventsArray<WebhookEvent>

Events to which the webhook is subscribed

signing_secretread-onlytext

Secret used to sign each notification sent to the webhook. Verify notifications with the Standard Webhooks headers (webhook-id, webhook-timestamp, webhook-signature: HMAC-SHA256 with this secret as key). The X-Signature header (MD5) is deprecated and will be removed in the future

sourcetext

Where the webhook was registered: the admin, the API or an external tool such as Zapier

Related resources

Embed related resources in the response with the select parameter, for example select=*,organizations(*). See selecting data. Resources related through more than one column need the column as a hint, like table!column(*).

organizations(*)object | null

organizations.id

The organization referenced by organization_id.

webhook_notifications(*)array

webhook_notifications.webhook_id

The webhook notifications referencing this webhook through webhook_notifications.webhook_id.

The webhook object

JSON

{
  "id": "00000000-0000-0000-0000-000000000000",
  "grant_id": "00000000-0000-0000-0000-000000000000",
  "organization_id": "00000000-0000-0000-0000-000000000000",
  "created_at": "2026-01-01T12:00:00+00:00",
  "updated_at": "2026-01-01T12:00:00+00:00",
  "description": "",
  "disabled_at": null,
  "endpoint": "",
  "events": [
    "candidates.created",
    "members.updated"
  ],
  "signing_secret": "",
  "source": ""
}

Including related resources

curl "https://api.cv-transformer.com/v1/webhooks?limit=10&select=*,organizations(*),webhook_notifications(*)" \
  -H "Authorization: Bearer YOUR_API_KEY"

List webhooks

Requireswebhooks:read

Filters

idFilter<uuid>

Unique identifier

grant_idFilter<uuid | null>

oauth_grants.id

Identifier of the OAuth grant that created the webhook. Revoking the grant, or its access to the organization, disables the webhook

organization_idFilter<uuid>

organizations.id

Identifier of the related organization

created_atFilter<timestamp with time zone>

Creation timestamp

updated_atFilter<timestamp with time zone>

Last modification timestamp

descriptionFilter<text>

Description of the webhook, if any

disabled_atFilter<timestamp with time zone | null>

When the webhook was disabled, because its endpoint kept failing or the OAuth grant that created it lost access. A disabled webhook gets no notifications; set this to null to enable it again

endpointFilter<text>

URL notifications are sent to

eventsFilter<Array<WebhookEvent>>

Events to which the webhook is subscribed

signing_secretFilter<text>

sourceFilter<text>

Where the webhook was registered: the admin, the API or an external tool such as Zapier

Responses

200

A list of webhooks with the selected columns. The Content-Range header holds the range returned and the total count, like 0-9/42.

206

Partial Content

400

The request is malformed, for example an unknown column or an invalid filter.

401

The API key is missing or invalid.

403

The API key doesn't have the scope this request needs.

429

The API key made more requests per minute than its rate limit allows. Retry after the number of seconds in the Retry-After header.

Errors have a JSON body with a message, details and hint, and for database errors a code. See errors.

GET/webhooks

curl "https://api.cv-transformer.com/v1/webhooks?limit=10&select=*" \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

JSON

[
  {
    "id": "00000000-0000-0000-0000-000000000000",
    "grant_id": "00000000-0000-0000-0000-000000000000",
    "organization_id": "00000000-0000-0000-0000-000000000000",
    "created_at": "2026-01-01T12:00:00+00:00",
    "updated_at": "2026-01-01T12:00:00+00:00",
    "description": "",
    "disabled_at": null,
    "endpoint": "",
    "events": [
      "candidates.created",
      "members.updated"
    ],
    "signing_secret": "",
    "source": ""
  }
]

Create webhooks

Requireswebhooks:write

Body

Partial<Webhook> | Array<Partial<Webhook>>

The attributes are listed under the webhook object. Read-only attributes are set by CV-Transformer and can't be written.

Responses

201

Created. With the header Prefer: return=representation, the body holds the created webhooks with the selected columns.

400

The request is malformed, for example an unknown column, an invalid filter or an invalid body.

401

The API key is missing or invalid.

403

The API key doesn't have the scope this request needs, or no permission for this change, for example when writing rows of another organization.

409

The change conflicts with existing data, for example a duplicate key or a reference to a row that does not exist.

429

The API key made more requests per minute than its rate limit allows. Retry after the number of seconds in the Retry-After header.

Errors have a JSON body with a message, details and hint, and for database errors a code. See errors.

POST/webhooks

curl "https://api.cv-transformer.com/v1/webhooks" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "organization_id": "00000000-0000-0000-0000-000000000000",
    "description": "",
    "endpoint": "",
    "events": ["candidates.created", "members.updated"],
    "source": ""
  }'

Example response

JSON

(no content)

Delete webhooks

Requireswebhooks:write

Filters

Without filters, this request deletes all webhooks the API key has access to. Always filter on at least one column, like id=eq.{id}.

idFilter<uuid>

Unique identifier

grant_idFilter<uuid | null>

oauth_grants.id

Identifier of the OAuth grant that created the webhook. Revoking the grant, or its access to the organization, disables the webhook

organization_idFilter<uuid>

organizations.id

Identifier of the related organization

created_atFilter<timestamp with time zone>

Creation timestamp

updated_atFilter<timestamp with time zone>

Last modification timestamp

descriptionFilter<text>

Description of the webhook, if any

disabled_atFilter<timestamp with time zone | null>

When the webhook was disabled, because its endpoint kept failing or the OAuth grant that created it lost access. A disabled webhook gets no notifications; set this to null to enable it again

endpointFilter<text>

URL notifications are sent to

eventsFilter<Array<WebhookEvent>>

Events to which the webhook is subscribed

signing_secretFilter<text>

sourceFilter<text>

Where the webhook was registered: the admin, the API or an external tool such as Zapier

Responses

204

Deleted. With the header Prefer: return=representation, the response is a 200 whose body holds the deleted webhooks with the selected columns.

400

The request is malformed, for example an unknown column or an invalid filter.

401

The API key is missing or invalid.

403

The API key doesn't have the scope this request needs, or no permission for this change, for example when writing rows of another organization.

429

The API key made more requests per minute than its rate limit allows. Retry after the number of seconds in the Retry-After header.

Errors have a JSON body with a message, details and hint, and for database errors a code. See errors.

DELETE/webhooks

curl -X DELETE "https://api.cv-transformer.com/v1/webhooks?id=eq.00000000-0000-0000-0000-000000000000" \
  -H "Authorization: Bearer YOUR_API_KEY"

Example response

JSON

(no content)

Update webhooks

Requireswebhooks:write

Filters

Without filters, this request updates all webhooks the API key has access to. Always filter on at least one column, like id=eq.{id}.

idFilter<uuid>

Unique identifier

grant_idFilter<uuid | null>

oauth_grants.id

Identifier of the OAuth grant that created the webhook. Revoking the grant, or its access to the organization, disables the webhook

organization_idFilter<uuid>

organizations.id

Identifier of the related organization

created_atFilter<timestamp with time zone>

Creation timestamp

updated_atFilter<timestamp with time zone>

Last modification timestamp

descriptionFilter<text>

Description of the webhook, if any

disabled_atFilter<timestamp with time zone | null>

When the webhook was disabled, because its endpoint kept failing or the OAuth grant that created it lost access. A disabled webhook gets no notifications; set this to null to enable it again

endpointFilter<text>

URL notifications are sent to

eventsFilter<Array<WebhookEvent>>

Events to which the webhook is subscribed

signing_secretFilter<text>

sourceFilter<text>

Where the webhook was registered: the admin, the API or an external tool such as Zapier

Body

Partial<Webhook>

The attributes are listed under the webhook object. Read-only attributes are set by CV-Transformer and can't be written.

Responses

204

Updated. With the header Prefer: return=representation, the response is a 200 whose body holds the updated webhooks with the selected columns.

400

The request is malformed, for example an unknown column, an invalid filter or an invalid body.

401

The API key is missing or invalid.

403

The API key doesn't have the scope this request needs, or no permission for this change, for example when writing rows of another organization.

409

The change conflicts with existing data, for example a duplicate key or a reference to a row that does not exist.

429

The API key made more requests per minute than its rate limit allows. Retry after the number of seconds in the Retry-After header.

Errors have a JSON body with a message, details and hint, and for database errors a code. See errors.

PATCH/webhooks

curl -X PATCH "https://api.cv-transformer.com/v1/webhooks?id=eq.00000000-0000-0000-0000-000000000000" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "description": "" }'

Example response

JSON

(no content)

Webhooks

The webhook object#

Attributes

Related resources#

List webhooks#

Filters

Responses

Create webhooks#

Body

Responses

Delete webhooks#

Filters

Responses

Update webhooks#

Filters

Body

Responses

The webhook object

Related resources

List webhooks

Create webhooks

Delete webhooks

Update webhooks