Jelliu API documentation

curl -X PATCH https://api.jelliu.co/api/webhooks/9a7b6c5d-4e3f-4a2b-8c1d-0e9f8a7b6c5d \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "events": [
    "call.completed",
    "campaign.completed"
  ],
  "filters": {
    "agent_ids": [
      "2c4e6a8b-0d1f-4e3a-9b5c-7d9e1f3a5b7c"
    ]
  }
}'

{
  "data": {
    "id": "5d2f8a4c-1b3e-4f6a-9c7d-8e0f1a2b3c4d",
    "url": "https://hooks.inmobiliariaandina.co/jelliu/llamadas",
    "description": "Sincronizar llamadas con el CRM",
    "events": [
      "call.completed",
      "campaign.completed"
    ],
    "filters": {
      "agent_ids": [
        "2c4e6a8b-0d1f-4e3a-9b5c-7d9e1f3a5b7c"
      ]
    },
    "headers": {
      "Authorization": "[configured]"
    },
    "is_active": true,
    "disabled_reason": null,
    "disabled_at": null,
    "consecutive_failures": 0,
    "last_delivery_status": "succeeded",
    "last_delivery_at": "2026-09-27T21:04:05.402Z",
    "previous_secret_valid_until": null,
    "created_at": "2026-09-01T13:20:00.000Z",
    "updated_at": "2026-09-27T21:10:00.000Z"
  }
}

Updates only the fields sent; all others keep their stored values. At least one field is required. To deactivate or reactivate an endpoint, use POST /api/webhooks/{webhookId}/disable and /enable (is_active is not accepted). To replace the secret, use POST /api/webhooks/{webhookId}/rotate-secret.

events replaces the whole list. A name the endpoint already lists remains accepted even if the catalog no longer offers it; a new name must be available for subscription.
filters replaces the stored object; null removes every filter.
headers replaces all custom headers; null or {} removes them. Reads return each value as "[configured]", so the object returned by a read can be sent back as is: a header whose value is "[configured]" keeps its stored value, and a masked header with no stored value is dropped. Send a new value to change a header.
description: null clears the label.
The rule against call filters on audit.log_recorded is evaluated on the resulting configuration (stored values merged with the values sent).
A new url is subject to the same checks as on create.

Changing url or headers redirects a live integration (or changes the credential it sends), so it requires a signed-in owner or admin; API keys are rejected with 403 regardless of scope. All other fields can be changed with a full key.

Side effects. Updates the endpoint and updated_at. The next delivery attempt, including pending retries, uses the new configuration. Written to the audit log with url and headers redacted.

Idempotency. Safe to retry: sending the same body again leaves the endpoint in the same state.

Webhook events. Emits audit.log_recorded to endpoints subscribed to it. See Webhooks.

Access

Required scope: full (a signed-in session for url and headers). Human users need the owner or admin role.
Rate limit: General API (120–600 requests/min per workspace, by plan) plus the configuration-mutations limit — 10 requests/min per workspace, shared with other configuration changes. See Rate limits.
Plan: Requires an active subscription (active, trialing or past_due); without one the request is refused with 403 BILLING_ERROR (metadata.kind: subscription_required). See Billing and usage.

Authentication

AuthorizationBearer

Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.

Scope	GET / HEAD	POST / PUT / PATCH / DELETE	Admin-only routes
`read`	Yes	No	No
`write`	Yes	Yes	No
`full`	Yes	Yes	Yes

Operations restricted to admins or owners reject keys without the full scope with 403, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See Authentication.

Path parameters

webhookIdstringRequiredformat: "uuid"

UUID of the outbound webhook endpoint, returned as id by GET /api/webhooks. It must belong to the authenticated workspace; an id from another workspace, an unknown id or a value that is not a UUID answers 404.

Request

This endpoint expects an object.

urlstringOptionalformat: "uri"<=2000 characters

New endpoint. Same checks as on create. Signed-in session only.

eventslist of stringsOptional

Replaces the whole list. A name the endpoint already lists remains accepted even if the catalog no longer offers it; a new name must be available for subscription.

descriptionstring or nullOptional<=500 characters

New label; null clears it.

filtersobject or nullOptional

Replaces the stored filters; null removes them. The audit-filter rule is checked on the result.

headersmap from strings to strings or nullOptional

Replaces all custom headers; null or {} removes them. Same rules as on create. A value of "[configured]" (as returned by reads) keeps the stored value for that name; a masked header with no stored value is dropped. Signed-in session only.

Response

The updated endpoint.

dataobject

An outbound webhook endpoint as returned by the API. The signing secret is never included; it is returned once by POST /api/webhooks (as an additional secret field) and by rotate-secret. Custom headers keep their names, but every value is "[configured]". Members below admin (and API keys without the full scope) see only the origin of url.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

429

Too Many Requests Error