Webhooks and API

Operator alerts

The server can POST a JSON body to ALERT_WEBHOOK_URL when the process is not ready, or when jobs look stuck. If the variable is empty, nothing is sent. The URL is an operator setting. It is not shown in the product, and it is not a customer webhook.

The body looks like this:

{
  "kind": "stuck_jobs",
  "message": "2 jobs look stuck",
  "at": "2026-11-10T15:04:00.000Z",
  "details": { "stuckJobs": 2 }
}

kind is readiness_failed or stuck_jobs. Stuck-job alerts are sent at most once every five minutes while jobs are still stuck. The message does not include tokens, captions, or account secrets. A field whose name looks like a secret is redacted before it is logged.

This webhook does not fire when a post is published, fails, or needs a lookup. Those customer events are coming soon. When they exist, each subscription will be a URL you add in the product, signed so you can tell it came from your workspace, and limited to the brands you choose. They will not include network tokens.

HTTP APIs that exist

The web app calls a session API on the same host. The browser sends the session cookie and a CSRF token on changes. That API is for the signed-in product. It is not a public integration key, and there is no API token to create for it. A token API for integrations other than MCP is coming soon.

These paths do not require a sign-in and do not return customer data:

Path	Answer
GET /api/health and GET /healthz	{"ok":true} when the process is up
GET /readyz	Also checks the database, migrations, the media folder, and the worker
GET /metrics	Process metrics for the operator

Home, calendar, campaigns, accounts, and settings require a signed-in user. A visitor who is not signed in is refused by /api/auth/me.

Assistants use the MCP server on its own port and origin. MCP keys are not session cookies. OAuth metadata for MCP clients is GET /.well-known/oauth-protected-resource/mcp on the MCP origin and GET /.well-known/oauth-authorization-server on the API origin.

Do not send network tokens, session cookies, or MCP keys to a webhook.