API v1

API Reference

Everything you need to integrate with Eventpipe. RESTful API, predictable responses, comprehensive examples.

Authentication

All API requests require an API key passed via the X-API-Key header. You can generate keys in your dashboard.

Keep your API keys secure. Do not expose them in client-side code or public repositories. Use separate keys for production and development environments.

curl -H "X-API-Key: ep_live_abc123def456" \
  https://api.eventpipe.dev/v1/events

Keys are prefixed with ep_live_ for production and ep_test_ for test mode.

Events

POST /api/v1/events Send an event

Submit a new event for routing and delivery. Eventpipe will match the event against all active subscriptions and deliver it to the configured endpoints.

Request Body
Parameter Type Required Description
type string required Event type identifier, e.g. order.created
source string required Origin system of the event, e.g. shopify
payload object required Arbitrary JSON payload to deliver to subscribers
idempotency_key string optional Unique key to prevent duplicate event delivery
Example Request
curl -X POST https://api.eventpipe.dev/v1/events \
  -H "X-API-Key: ep_live_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "order.created",
    "source": "shopify",
    "payload": {
      "order_id": "ord_12345",
      "amount": 99.00,
      "currency": "USD"
    }
  }'
Example Response 200 OK
{
  "id": "evt_a1b2c3d4e5",
  "type": "order.created",
  "source": "shopify",
  "status": "accepted",
  "created_at": "2025-02-10T14:30:00Z"
}
GET /api/v1/events/:id Get event status

Retrieve event details and delivery status. Includes all delivery attempts with HTTP status codes and timing information.

Path Parameters
Parameter Type Required Description
id string required Event ID returned from the send endpoint
Example Response 200 OK
{
  "id": "evt_a1b2c3d4e5",
  "type": "order.created",
  "source": "shopify",
  "status": "delivered",
  "created_at": "2025-02-10T14:30:00Z",
  "delivery_attempts": [
    {
      "endpoint_id": "end_xyz789",
      "status": "success",
      "http_status": 200,
      "attempted_at": "2025-02-10T14:30:01Z",
      "duration_ms": 145
    }
  ]
}

Endpoints

POST /api/v1/endpoints Register endpoint

Register a new webhook endpoint to receive event deliveries. Eventpipe will send HTTP POST requests to your URL when matching events arrive.

Request Body
Parameter Type Required Description
url string required HTTPS URL to deliver events to
events array required Event type patterns to subscribe to, e.g. ["order.*"]
active boolean optional Whether the endpoint is active. Defaults to true
Example Request
curl -X POST https://api.eventpipe.dev/v1/endpoints \
  -H "X-API-Key: ep_live_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://app.example.com/webhooks",
    "events": ["order.*"]
  }'
Example Response 201 Created
{
  "id": "end_xyz789",
  "url": "https://app.example.com/webhooks",
  "events": ["order.*"],
  "active": true,
  "secret": "whsec_k8s9d7f6g5h4j3k2",
  "created_at": "2025-02-10T14:00:00Z"
}

The secret field is only returned once at creation time. Store it securely — use it to verify incoming webhook signatures.

GET /api/v1/endpoints List endpoints

Returns a paginated list of all webhook endpoints registered to your account.

Query Parameters
Parameter Type Required Description
active boolean optional Filter by active status
limit integer optional Number of results per page. Default 20, max 100
cursor string optional Pagination cursor from a previous response
Example Response 200 OK
{
  "data": [
    {
      "id": "end_xyz789",
      "url": "https://app.example.com/webhooks",
      "events": ["order.*"],
      "active": true,
      "created_at": "2025-02-10T14:00:00Z"
    }
  ],
  "has_more": false,
  "next_cursor": null
}
DELETE /api/v1/endpoints/:id Remove endpoint

Permanently removes a webhook endpoint. All associated subscriptions will be deleted. In-flight deliveries will still be attempted.

Path Parameters
Parameter Type Required Description
id string required Endpoint ID to delete
Example Response 200 OK
{ "deleted": true }

Subscriptions

POST /api/v1/subscriptions Create routing subscription

Create a routing subscription to filter which events are delivered to a specific endpoint. Use pattern matching on type and source to control routing logic.

Request Body
Parameter Type Required Description
endpoint_id string required ID of the endpoint to route matching events to
filter object required Routing filter with type and/or source patterns
Example Request
curl -X POST https://api.eventpipe.dev/v1/subscriptions \
  -H "X-API-Key: ep_live_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint_id": "end_xyz789",
    "filter": {
      "type": "payment.*",
      "source": "stripe"
    }
  }'
Example Response 201 Created
{
  "id": "sub_m3n4o5p6q7",
  "endpoint_id": "end_xyz789",
  "filter": {
    "type": "payment.*",
    "source": "stripe"
  },
  "active": true,
  "created_at": "2025-02-10T15:00:00Z"
}
GET /api/v1/subscriptions List subscriptions

Returns a paginated list of all routing subscriptions. Optionally filter by endpoint.

Query Parameters
Parameter Type Required Description
endpoint_id string optional Filter subscriptions by endpoint ID
limit integer optional Number of results per page. Default 20, max 100
Example Response 200 OK
{
  "data": [
    {
      "id": "sub_m3n4o5p6q7",
      "endpoint_id": "end_xyz789",
      "filter": {
        "type": "payment.*",
        "source": "stripe"
      },
      "active": true,
      "created_at": "2025-02-10T15:00:00Z"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Logs

GET /api/v1/logs Delivery logs

Query delivery logs across all endpoints. Supports filtering by event, endpoint, status, and time range. Useful for debugging failed deliveries and auditing delivery history.

Query Parameters
Parameter Type Required Description
event_id string optional Filter logs for a specific event
endpoint_id string optional Filter logs for a specific endpoint
status string optional Filter by delivery status: success, failed, or pending
from string optional ISO 8601 datetime — start of time range
to string optional ISO 8601 datetime — end of time range
limit integer optional Number of results. Default 50, max 100
Example Request
curl "https://api.eventpipe.dev/v1/logs?status=failed&limit=10" \
  -H "X-API-Key: ep_live_abc123def456"
Example Response 200 OK
{
  "data": [
    {
      "id": "log_abc123",
      "event_id": "evt_a1b2c3d4e5",
      "endpoint_id": "end_xyz789",
      "status": "success",
      "http_status": 200,
      "duration_ms": 145,
      "attempted_at": "2025-02-10T14:30:01Z"
    }
  ],
  "has_more": false,
  "total": 1
}

Webhook Signature Verification

Eventpipe signs all outgoing webhook deliveries with HMAC-SHA256 using your endpoint's secret. Verify the X-Eventpipe-Signature header to ensure authenticity.

The signature is a hex-encoded HMAC-SHA256 digest of the raw request body. Always use the raw body bytes — not a parsed or reformatted version.

Node.js Verification Example
const crypto = require('crypto');

function verifySignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your webhook handler
app.post('/webhooks', (req, res) => {
  const signature = req.headers['x-eventpipe-signature'];
  const isValid = verifySignature(req.rawBody, signature, endpointSecret);

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Process the event
  res.status(200).json({ received: true });
});

Use crypto.timingSafeEqual to prevent timing attacks. Never use a simple string comparison for signature verification.

Rate Limits

API requests are rate-limited per API key. Limits vary by plan:

Plan Rate Limit Burst
Free 10 requests / second Up to 20
Pro 100 requests / second Up to 200
Business 1,000 requests / second Up to 2,000

When rate limited, the API returns 429 Too Many Requests with a Retry-After header indicating how many seconds to wait before retrying.

Example Response 429 Too Many Requests
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Please retry after 2 seconds.",
  "retry_after": 2
}

Need higher limits? Contact us to discuss a custom plan.