PLATFORM

Webhooks

Create signed outbound webhooks with durable, owner-scoped delivery behavior.

GET/api/developer/webhooks

List webhook subscriptions

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/webhooks'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks

Create a signed webhook subscription

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/developer/webhooks/deliveries

List delivery metadata

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/webhooks/deliveries'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/test

Deliver a signed test event

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/test'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/deliveries/process

Queue due deliveries

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/deliveries/process'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/deliveries/retry

Retry an owned delivery

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/deliveries/retry'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/rotate

Rotate a signing secret

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/rotate'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/disable

Disable a webhook subscription

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/disable'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Webhook subscriptions require HTTPS endpoints and supported event names. Signing secrets are shown once; a hash and encrypted server-side copy support future verification and delivery.

Create a subscription

POST /api/developer/webhooks
Origin: https://identity.lucionglobal.com
Cookie: YOUR_IDENTITY_SESSION_AND_CSRF_COOKIES
Content-Type: application/json
X-Lucion-CSRF: VALUE_MATCHING_CSRF_COOKIE
Idempotency-Key: webhook-create-2026-11-01

{
  "application_id": "app_YOUR_APPLICATION_ID",
  "endpoint_url": "https://app.example.com/hooks/lucion",
  "events": ["identity.user.created", "identity.user.updated"]
}

Illustrative create response

{
  "webhook": {
    "id": "whk_REDACTED",
    "application_id": "app_REDACTED",
    "endpoint_url": "https://app.example.com/hooks/lucion",
    "events": ["identity.user.created", "identity.user.updated"],
    "signing_secret": "REDACTED_SHOWS_ONCE"
  },
  "secret_shown_once": true
}