Manage API & Webhooks

API & Webhooks is the organization page for internal automation and event delivery. Open the organization, go to Organization settings, and select API & Webhooks under Integrations.

This page is separate from App Center. App Center connects and lists applications that can access the organization. API & Webhooks covers organization-owned service accounts, bearer tokens, signing principals, webhook endpoints, deliveries, and replay.

API credentials

Service accounts are organization-owned connections used by internal automation. Each row shows the creator, scopes, credential state, last use, expiry, token prefix, and revocation effect.

Create a separate service account for each environment or automation owner. Select only the scopes required by the consumer and choose channel access carefully when chat scopes are present. Direct-message access remains unavailable.

Copy a new or rotated token immediately because the complete value is shown once. Store it in a secrets manager rather than source control, browser code, URLs, screenshots, analytics, or support tickets.

Rotation replaces the active token for the existing service account. Revocation permanently disables the credential. When no active credential remains for the principal, RIIW also revokes webhook endpoints owned by that principal and cancels their pending deliveries.

Signing principals

Every webhook endpoint belongs to an active service account or OAuth principal. Select Signing principal to open the dropdown and choose the identity that should own the endpoint. The dropdown describes each principal’s owner and scopes so that an endpoint is not accidentally attached to the wrong automation identity.

If the dropdown is disabled or empty, create an active API credential first or confirm that your role can read integration principals. Expired, suspended, and revoked principals cannot own a new endpoint.

Webhook endpoints

Enter a recognizable endpoint name, a public HTTPS receiver, and the required event types. Select Verify and activate only after the receiver can validate the signed test request and return a success status promptly.

Each webhook row shows organization ownership, status, inherited scope context, signing principal, last use or success, and removal effect. Use Deliveries to inspect attempts, Test / resume after fixing a receiver, and Replay for eligible terminal deliveries from the last seven days.

Removing an endpoint deletes its signing material and cancels queued deliveries. Rotating a secret is different: the endpoint remains active and a limited grace period supports deployment of the replacement secret.

Permissions and plans

Combining the controls on one page does not combine their authorization rules:

• API credential creation, rotation, and revocation require API credential management capability and the Public API plan module.
• Webhook creation, testing, secret rotation, replay, and removal require webhook management capability and the Webhooks plan module.
• A user with only API permission sees API controls but not webhook controls.
• A user with only webhook permission sees webhook controls and the principals needed for endpoint ownership, but cannot create or rotate API credentials.

Section-specific plan notices remain visible. A temporary platform pause does not revoke credentials; API operations return a temporary failure and pending webhook deliveries remain preserved until processing resumes.

Old Public API, API token, and Webhooks settings links redirect to API & Webhooks. The transitional combined Apps & Integrations URL also redirects here when its integrationArea identifies API and webhook controls. Existing credentials, token digests, endpoint secrets, delivery history, and OAuth grants are preserved.

For application discovery and OAuth authorization management, use Manage App Center. For implementation details, continue with Create and manage API credentials or Configure and verify webhooks.