← Back

API & MCP

Read-only access to the webhook logs of a workspace, for your scripts and for your agents.

Authentication

Every call is authenticated with a workspace API key, sent as a bearer token. Create one from Workspace settings → Agent access: the secret is shown once, only its hash is stored. A key is bound to the workspace that created it and can never read another one.

curl -H "Authorization: Bearer whd_sk_..." \
  https://webhook.impulselab.ai/api/v1/requests?limit=5

A missing, revoked or expired key answers 401. Calls are limited to 120 per 60 seconds per key, after which the API answers 429 with a Retry-After header.

Endpoints

Base url https://webhook.impulselab.ai/api/v1. Everything is read-only: no endpoint can create, modify or delete anything.

GET /webhooks

Webhooks of the workspace and their recent activity.

GET /requests

Requests received, newest first. Filters: webhookId, method, search, since, until.

GET /requests/{requestId}

Full payload of one request with its delivery attempts and tunnel state.

GET /stats

Request volume and delivery error rate over a time window.

GET /cli-connections

Reroute CLI tunnels attached to the workspace webhooks.

Credential headers (authorization, cookies, signatures) are masked in responses. Pass includeSecrets=true on the request detail endpoint to read them in clear.

Connect an agent (MCP)

The same key opens the MCP endpoint at https://webhook.impulselab.ai/api/mcp, which exposes the endpoints above as tools: list_webhooks, list_requests, get_request, get_stats and list_cli_connections.

Hephaistos, Cursor, or any client reading a JSON config

{
  "mcpServers": {
    "webhook-dispatcher": {
      "type": "http",
      "url": "https://webhook.impulselab.ai/api/mcp",
      "headers": { "Authorization": "Bearer whd_sk_..." }
    }
  }
}

Claude Code

claude mcp add --transport http webhook-dispatcher https://webhook.impulselab.ai/api/mcp --header "Authorization: Bearer whd_sk_..."

Replace whd_sk_... with the key you created. The endpoint is stateless HTTP: no SSE session to keep alive, no OAuth dance.

OpenAPI document

The contract is published at /api/v1/openapi.json, without authentication, and can be fed to any OpenAPI client generator.

Reference