Las operaciones marcadas /v1 se autentican con un token de agente; las demás, con una sesión del panel. Cómo funcionan ambas está en Autenticación
GET/v1/list-webhook-deliveries
Miembro de la firmaPermiso: webhook:manage/v1 · token BearerHerramienta MCP: listWebhookDeliveries
One endpoint's delivery log: status, attempts, HTTP answer, next try.
Parámetros de listWebhookDeliveries| Nombre | Dónde | Tipo | Obligatorio |
|---|
endpointId | Consulta | string (uuid) | Sí |
limit | Consulta | integer 1–100 | No |
orgId | Consulta | string (uuid) | Sí |
_first | Consulta | integer 1–500page size; present, the response is the page envelope rather than the bare rows (1 to 500) | No |
_after | Consulta | stringthe nextCursor a previous page answered; needs _first | No |
curlcurl 'https://www.notificado.co/v1/list-webhook-deliveries?endpointId=<endpointId>&orgId=<orgId>' \
-H "authorization: Bearer $NOTIFICADO_TOKEN"
TypeScriptconst response = await fetch('https://www.notificado.co/v1/list-webhook-deliveries?endpointId=<endpointId>&orgId=<orgId>', {
headers: { authorization: `Bearer ${token}` },
});
const result = await response.json();
Ejemplo de respuesta
200[
null
]
Errores
400 X_INPUT_INVALID or X_CURSOR_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied429 X_RATE_LIMITED — retry after Retry-After seconds
GET/v1/list-webhook-endpoints
Miembro de la firmaPermiso: webhook:manage/v1 · token BearerHerramienta MCP: listWebhookEndpoints
The firm's webhook endpoints and their status; never the secret.
Parámetros de listWebhookEndpoints| Nombre | Dónde | Tipo | Obligatorio |
|---|
orgId | Consulta | string (uuid) | Sí |
_first | Consulta | integer 1–500page size; present, the response is the page envelope rather than the bare rows (1 to 500) | No |
_after | Consulta | stringthe nextCursor a previous page answered; needs _first | No |
curlcurl 'https://www.notificado.co/v1/list-webhook-endpoints?orgId=<orgId>' \
-H "authorization: Bearer $NOTIFICADO_TOKEN"
TypeScriptconst response = await fetch('https://www.notificado.co/v1/list-webhook-endpoints?orgId=<orgId>', {
headers: { authorization: `Bearer ${token}` },
});
const result = await response.json();
Ejemplo de respuesta
200[
null
]
Errores
400 X_INPUT_INVALID or X_CURSOR_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied429 X_RATE_LIMITED — retry after Retry-After seconds
GET/_x/query/oauth-consent
Miembro de la firmaPermiso: or(api-access:write, admin:tokens:self)
oauthConsent
Parámetros de oauthConsent| Nombre | Dónde | Tipo | Obligatorio |
|---|
client_id | Consulta | string 1–2000 | No |
code_challenge | Consulta | string 1–2000 | No |
code_challenge_method | Consulta | string 1–2000 | No |
orgId | Consulta | string (uuid) | Sí |
redirect_uri | Consulta | string 1–2000 | No |
resource | Consulta | string 1–2000 | No |
response_type | Consulta | string 1–2000 | No |
scope | Consulta | string 1–2000 | No |
state | Consulta | string 1–4096 | No |
_first | Consulta | integer 1–500page size; present, the response is the page envelope rather than the bare rows (1 to 500) | No |
_after | Consulta | stringthe nextCursor a previous page answered; needs _first | No |
curlcurl 'https://www.notificado.co/_x/query/oauth-consent?orgId=<orgId>' \
-b cookies.txt
TypeScriptconst response = await fetch('https://www.notificado.co/_x/query/oauth-consent?orgId=<orgId>', {
headers: { cookie: sessionCookie },
});
const result = await response.json();
Ejemplo de respuesta
200[
null
]
Errores
400 X_INPUT_INVALID or X_CURSOR_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied429 X_RATE_LIMITED — retry after Retry-After seconds
GET/_x/query/oauth-handoff
Miembro de la firmaPermiso: or(api-access:write, admin:tokens:self)
oauthHandoff
Parámetros de oauthHandoff| Nombre | Dónde | Tipo | Obligatorio |
|---|
code | Consulta | string 1–200 | Sí |
orgId | Consulta | string (uuid) | Sí |
userId | Consulta | string (uuid) | Sí |
_first | Consulta | integer 1–500page size; present, the response is the page envelope rather than the bare rows (1 to 500) | No |
_after | Consulta | stringthe nextCursor a previous page answered; needs _first | No |
curlcurl 'https://www.notificado.co/_x/query/oauth-handoff?code=<code>&orgId=<orgId>&userId=<userId>' \
-b cookies.txt
TypeScriptconst response = await fetch('https://www.notificado.co/_x/query/oauth-handoff?code=<code>&orgId=<orgId>&userId=<userId>', {
headers: { cookie: sessionCookie },
});
const result = await response.json();
Ejemplo de respuesta
200[
null
]
Errores
400 X_INPUT_INVALID or X_CURSOR_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied429 X_RATE_LIMITED — retry after Retry-After seconds
POST/api/authorize-client
Miembro de la firmaPermiso: or(api-access:write, admin:tokens:self)
authorizeClient
Parámetros de authorizeClient| Nombre | Dónde | Tipo | Obligatorio |
|---|
client_id | Cuerpo | string 1–100 | Sí |
code | Cuerpo | string 1–64 | No |
code_challenge | Cuerpo | string 1–2000 | No |
code_challenge_method | Cuerpo | string 1–2000 | No |
idle | Cuerpo | "60" | No |
orgId | Cuerpo | string (uuid) | Sí |
password | Cuerpo | string 1–1024 | No |
redirect_uri | Cuerpo | string 1–2000 | Sí |
resource | Cuerpo | string 1–2000 | No |
response_type | Cuerpo | string 1–2000 | No |
scope | Cuerpo | string 1–2000 | No |
scopes | Cuerpo | string 1–40 | array of string 1–40 | No |
state | Cuerpo | string 1–4096 | No |
curlcurl -X POST 'https://www.notificado.co/api/authorize-client' \
-b cookies.txt \
-H 'origin: https://www.notificado.co' \
-H 'content-type: application/json' \
-d '{
"client_id": "<client_id>",
"orgId": "<orgId>",
"redirect_uri": "<redirect_uri>"
}'
TypeScriptconst response = await fetch('https://www.notificado.co/api/authorize-client', {
method: 'POST',
headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
body: JSON.stringify({
"client_id": "<client_id>",
"orgId": "<orgId>",
"redirect_uri": "<redirect_uri>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"redirectTo": "<redirectTo>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/v1/create-webhook-endpoint
Miembro de la firmaPermiso: webhook:manage/v1 · token BearerHerramienta MCP: createWebhookEndpoint
Register a public https URL for signed event POSTs. The secret is shown ONCE. docs://recipes/set-up-a-webhook.
Parámetros de createWebhookEndpoint| Nombre | Dónde | Tipo | Obligatorio |
|---|
description | Cuerpo | string 1–200 | null | No |
eventTypes | Cuerpo | array of string 1–40 | Sí |
orgId | Cuerpo | string (uuid) | Sí |
url | Cuerpo | string 1–2000 | Sí |
curlcurl -X POST 'https://www.notificado.co/v1/create-webhook-endpoint' \
-H "authorization: Bearer $NOTIFICADO_TOKEN" \
-H 'content-type: application/json' \
-d '{"eventTypes":["<eventTypes>"],"orgId":"<orgId>","url":"<url>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/v1/create-webhook-endpoint', {
method: 'POST',
headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
body: JSON.stringify({
"eventTypes": [
"<eventTypes>"
],
"orgId": "<orgId>",
"url": "<url>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"endpoint": {
"createdAt": "<createdAt>",
"createdAtBogota": "<createdAtBogota>",
"description": "<description>",
"disabledAtBogota": "<disabledAtBogota>",
"eventTypes": [
"notification.sent"
],
"failureCount": -9007199254740991,
"id": "<id>",
"lastFailureAt": "<lastFailureAt>",
"lastFailureAtBogota": "<lastFailureAtBogota>",
"lastSuccessAt": "<lastSuccessAt>",
"lastSuccessAtBogota": "<lastSuccessAtBogota>",
"rotating": true,
"status": "active",
"url": "<url>"
},
"secret": "<secret>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/v1/delete-webhook-endpoint
Miembro de la firmaPermiso: webhook:manage/v1 · token BearerHerramienta MCP: deleteWebhookEndpoint
Stop sending to an endpoint: pending deliveries are cancelled, the log is kept.
Parámetros de deleteWebhookEndpoint| Nombre | Dónde | Tipo | Obligatorio |
|---|
endpointId | Cuerpo | string (uuid) | Sí |
orgId | Cuerpo | string (uuid) | Sí |
curlcurl -X POST 'https://www.notificado.co/v1/delete-webhook-endpoint' \
-H "authorization: Bearer $NOTIFICADO_TOKEN" \
-H 'content-type: application/json' \
-d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/v1/delete-webhook-endpoint', {
method: 'POST',
headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
body: JSON.stringify({
"endpointId": "<endpointId>",
"orgId": "<orgId>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"deleted": true,
"id": "<id>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/api/issue-agent-token
Miembro de la firmaPermiso: api-access:write
issueAgentToken
Parámetros de issueAgentToken| Nombre | Dónde | Tipo | Obligatorio |
|---|
code | Cuerpo | string 1–64 | No |
expiresOn | Cuerpo | string | No |
name | Cuerpo | string 1–100 | Sí |
orgId | Cuerpo | string (uuid) | Sí |
password | Cuerpo | string 1–1024 | No |
scopes | Cuerpo | array of string 1–40 | Sí |
ttlDays | Cuerpo | 30 | 60 | 90 | 180 | 365 | null | No |
curlcurl -X POST 'https://www.notificado.co/api/issue-agent-token' \
-b cookies.txt \
-H 'origin: https://www.notificado.co' \
-H 'content-type: application/json' \
-d '{"name":"<name>","orgId":"<orgId>","scopes":["<scopes>"]}'
TypeScriptconst response = await fetch('https://www.notificado.co/api/issue-agent-token', {
method: 'POST',
headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
body: JSON.stringify({
"name": "<name>",
"orgId": "<orgId>",
"scopes": [
"<scopes>"
]
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"summary": {
"createdAt": "2026-09-25T15:00:00Z",
"createdAtBogota": "<createdAtBogota>",
"expiresAt": "2026-09-25T15:00:00Z",
"expiresAtBogota": "<expiresAtBogota>",
"id": "<id>",
"lastUsedAt": "2026-09-25T15:00:00Z",
"lastUsedAtBogota": "<lastUsedAtBogota>",
"name": "<name>",
"oauthClient": "<oauthClient>",
"prefix": "<prefix>",
"revokedAt": "2026-09-25T15:00:00Z",
"revokedAtBogota": "<revokedAtBogota>",
"scopes": [
"cases:read"
],
"status": "active",
"userId": "<userId>"
},
"token": "<token>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/api/list-agent-tokens
Miembro de la firmaPermiso: api-access:read
listAgentTokens
Parámetros de listAgentTokens| Nombre | Dónde | Tipo | Obligatorio |
|---|
orgId | Cuerpo | string (uuid) | Sí |
curlcurl -X POST 'https://www.notificado.co/api/list-agent-tokens' \
-b cookies.txt \
-H 'origin: https://www.notificado.co' \
-H 'content-type: application/json' \
-d '{"orgId":"<orgId>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/api/list-agent-tokens', {
method: 'POST',
headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
body: JSON.stringify({
"orgId": "<orgId>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"tokens": [
{
"createdAt": "2026-09-25T15:00:00Z",
"createdAtBogota": "<createdAtBogota>",
"expiresAt": "2026-09-25T15:00:00Z",
"expiresAtBogota": "<expiresAtBogota>",
"id": "<id>",
"lastUsedAt": "2026-09-25T15:00:00Z",
"lastUsedAtBogota": "<lastUsedAtBogota>",
"name": "<name>",
"oauthClient": "<oauthClient>",
"prefix": "<prefix>",
"revokedAt": "2026-09-25T15:00:00Z",
"revokedAtBogota": "<revokedAtBogota>",
"scopes": [
"cases:read"
],
"status": "active",
"userId": "<userId>"
}
]
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/api/revoke-agent-token
Miembro de la firmaPermiso: or(api-access:write, org:read)
revokeAgentToken
Parámetros de revokeAgentToken| Nombre | Dónde | Tipo | Obligatorio |
|---|
orgId | Cuerpo | string (uuid) | Sí |
returnTo | Cuerpo | "api" | "security" | No |
tokenId | Cuerpo | string (uuid) | Sí |
curlcurl -X POST 'https://www.notificado.co/api/revoke-agent-token' \
-b cookies.txt \
-H 'origin: https://www.notificado.co' \
-H 'content-type: application/json' \
-d '{"orgId":"<orgId>","tokenId":"<tokenId>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/api/revoke-agent-token', {
method: 'POST',
headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
body: JSON.stringify({
"orgId": "<orgId>",
"tokenId": "<tokenId>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"createdAt": "2026-09-25T15:00:00Z",
"createdAtBogota": "<createdAtBogota>",
"expiresAt": "2026-09-25T15:00:00Z",
"expiresAtBogota": "<expiresAtBogota>",
"id": "<id>",
"lastUsedAt": "2026-09-25T15:00:00Z",
"lastUsedAtBogota": "<lastUsedAtBogota>",
"name": "<name>",
"oauthClient": "<oauthClient>",
"prefix": "<prefix>",
"revokedAt": "2026-09-25T15:00:00Z",
"revokedAtBogota": "<revokedAtBogota>",
"scopes": [
"cases:read"
],
"status": "active",
"userId": "<userId>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/v1/rotate-webhook-secret
Miembro de la firmaPermiso: webhook:manage/v1 · token BearerHerramienta MCP: rotateWebhookSecret
A new signing secret, shown ONCE; the old one also signs for 24 h.
Parámetros de rotateWebhookSecret| Nombre | Dónde | Tipo | Obligatorio |
|---|
endpointId | Cuerpo | string (uuid) | Sí |
orgId | Cuerpo | string (uuid) | Sí |
curlcurl -X POST 'https://www.notificado.co/v1/rotate-webhook-secret' \
-H "authorization: Bearer $NOTIFICADO_TOKEN" \
-H 'content-type: application/json' \
-d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/v1/rotate-webhook-secret', {
method: 'POST',
headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
body: JSON.stringify({
"endpointId": "<endpointId>",
"orgId": "<orgId>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"endpoint": {
"createdAt": "<createdAt>",
"createdAtBogota": "<createdAtBogota>",
"description": "<description>",
"disabledAtBogota": "<disabledAtBogota>",
"eventTypes": [
"notification.sent"
],
"failureCount": -9007199254740991,
"id": "<id>",
"lastFailureAt": "<lastFailureAt>",
"lastFailureAtBogota": "<lastFailureAtBogota>",
"lastSuccessAt": "<lastSuccessAt>",
"lastSuccessAtBogota": "<lastSuccessAtBogota>",
"rotating": true,
"status": "active",
"url": "<url>"
},
"secret": "<secret>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/v1/send-test-webhook
Miembro de la firmaPermiso: webhook:manage/v1 · token BearerHerramienta MCP: sendTestWebhook
POST a signed webhook.test now; answers the status, duration or failure.
Parámetros de sendTestWebhook| Nombre | Dónde | Tipo | Obligatorio |
|---|
endpointId | Cuerpo | string (uuid) | Sí |
orgId | Cuerpo | string (uuid) | Sí |
curlcurl -X POST 'https://www.notificado.co/v1/send-test-webhook' \
-H "authorization: Bearer $NOTIFICADO_TOKEN" \
-H 'content-type: application/json' \
-d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/v1/send-test-webhook', {
method: 'POST',
headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
body: JSON.stringify({
"endpointId": "<endpointId>",
"orgId": "<orgId>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"deliveryId": "<deliveryId>",
"durationMs": -9007199254740991,
"error": "http_status",
"ok": true,
"statusCode": -9007199254740991
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/api/update-agent-token-expiry
Miembro de la firmaPermiso: or(api-access:write, org:manage)
updateAgentTokenExpiry
Parámetros de updateAgentTokenExpiry| Nombre | Dónde | Tipo | Obligatorio |
|---|
code | Cuerpo | string 1–64 | No |
expiresOn | Cuerpo | string | No |
lifetime | Cuerpo | "30" | "60" | "90" | "180" | "365" | "never" | "date" | Sí |
orgId | Cuerpo | string (uuid) | Sí |
password | Cuerpo | string 1–1024 | No |
tokenId | Cuerpo | string (uuid) | Sí |
curlcurl -X POST 'https://www.notificado.co/api/update-agent-token-expiry' \
-b cookies.txt \
-H 'origin: https://www.notificado.co' \
-H 'content-type: application/json' \
-d '{"lifetime":"30","orgId":"<orgId>","tokenId":"<tokenId>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/api/update-agent-token-expiry', {
method: 'POST',
headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
body: JSON.stringify({
"lifetime": "30",
"orgId": "<orgId>",
"tokenId": "<tokenId>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"createdAt": "2026-09-25T15:00:00Z",
"createdAtBogota": "<createdAtBogota>",
"expiresAt": "2026-09-25T15:00:00Z",
"expiresAtBogota": "<expiresAtBogota>",
"id": "<id>",
"lastUsedAt": "2026-09-25T15:00:00Z",
"lastUsedAtBogota": "<lastUsedAtBogota>",
"name": "<name>",
"oauthClient": "<oauthClient>",
"prefix": "<prefix>",
"revokedAt": "2026-09-25T15:00:00Z",
"revokedAtBogota": "<revokedAtBogota>",
"scopes": [
"cases:read"
],
"status": "active",
"userId": "<userId>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds
POST/v1/update-webhook-endpoint
Miembro de la firmaPermiso: webhook:manage/v1 · token BearerHerramienta MCP: updateWebhookEndpoint
Change url, events or description; pause or resume (resuming delivers what waited).
Parámetros de updateWebhookEndpoint| Nombre | Dónde | Tipo | Obligatorio |
|---|
description | Cuerpo | string 1–200 | null | No |
endpointId | Cuerpo | string (uuid) | Sí |
eventTypes | Cuerpo | array of string 1–40 | No |
orgId | Cuerpo | string (uuid) | Sí |
state | Cuerpo | "active" | "paused" | No |
url | Cuerpo | string 1–2000 | No |
curlcurl -X POST 'https://www.notificado.co/v1/update-webhook-endpoint' \
-H "authorization: Bearer $NOTIFICADO_TOKEN" \
-H 'content-type: application/json' \
-d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'
TypeScriptconst response = await fetch('https://www.notificado.co/v1/update-webhook-endpoint', {
method: 'POST',
headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
body: JSON.stringify({
"endpointId": "<endpointId>",
"orgId": "<orgId>"
}),
});
const result = await response.json();
Ejemplo de respuesta
200{
"createdAt": "<createdAt>",
"createdAtBogota": "<createdAtBogota>",
"description": "<description>",
"disabledAtBogota": "<disabledAtBogota>",
"eventTypes": [
"notification.sent"
],
"failureCount": -9007199254740991,
"id": "<id>",
"lastFailureAt": "<lastFailureAt>",
"lastFailureAtBogota": "<lastFailureAtBogota>",
"lastSuccessAt": "<lastSuccessAt>",
"lastSuccessAtBogota": "<lastSuccessAtBogota>",
"rotating": true,
"status": "active",
"url": "<url>"
}
Errores
400 X_INPUT_INVALID401 X_UNAUTHENTICATED — no credential, or one that did not resolve403 policy denied422 X_BODY_INVALID429 X_RATE_LIMITED — retry after Retry-After seconds