API reference

This page is the capture URL: the address a webhook provider sends to, what it accepts, how the provider is detected, and what happens to an oversized or unsigned request. Managing FlurryPORT itself over HTTP is the REST API, a separate page.

Capture URL

The capture URL is the endpoint you register with your webhook provider. It accepts any HTTP method and stores the raw request (headers, body, query string) exactly as sent.

POST https://api.flurryport.io/api/v1/capture/{projectId}/{endpointSlug}

Quick test:

curl -X POST https://api.flurryport.io/api/v1/capture/{projectId}/{endpointSlug} \
  -H "Content-Type: application/json" \
  -d '{"event": "test.webhook", "data": {"id": "evt_123"}}'

Provider detection

FlurryPORT automatically detects the webhook provider from request headers:

The provider hint and event type (e.g., checkout.session.completed) are stored as metadata for filtering. They do not affect how the payload is stored.

Detection vs validation

Provider auto-detection identifies the sender from signature headers so captures are labeled correctly. It does not reject anything on its own. To enforce authenticity, configure signature validation on the endpoint (signing secret, header, and scheme). When validation is enabled, FlurryPORT verifies the signature on every incoming request and rejects invalid ones with a 401, storing them as flagged rejected captures.

See Signature validation.

Payload limits

The maximum payload a capture URL accepts, and how long a capture is kept, both depend on the project’s plan. The free Deckhand plan accepts 64 KB and keeps captures for three days; the full table for every plan is on the plans and limits page.

Authentication

Authenticated API operations (managing replay targets, triggering replays from the CLI, etc.) use a Personal Access Token (PAT). Generate one in Settings → Access Tokens.

# Generate in the UI, token shown once:
fp_a1b2c3d4e5f6...

# Use in requests:
Authorization: Bearer fp_a1b2c3d4e5f6...

Tokens are SHA256-hashed at rest. Set an expiry when creating: expired tokens are automatically rejected. Revoke compromised tokens immediately in Settings.

Webhook replay compatibility

When replaying webhooks with HMAC signature verification (e.g., Stripe), keep in mind: