Agent tokens

14 operations, each with its parameters, curl and TypeScript examples ready to copy, and its errors.

Operations marked /v1 authenticate with an agent token; the rest, with a panel session. How both work is in Authentication

`listWebhookDeliveries`

GET/v1/list-webhook-deliveries

Firm memberPermission: webhook:manage/v1 · bearer tokenMCP tool: listWebhookDeliveries

One endpoint's delivery log: status, attempts, HTTP answer, next try.

Parameters of listWebhookDeliveries
Name	In	Type	Required
`endpointId`	Query	`string (uuid)`	Yes
`limit`	Query	`integer 1–100`	No
`orgId`	Query	`string (uuid)`	Yes
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/v1/list-webhook-deliveries?endpointId=<endpointId>&orgId=<orgId>' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN"

TypeScript

const response = await fetch('https://www.notificado.co/v1/list-webhook-deliveries?endpointId=<endpointId>&orgId=<orgId>', {
  headers: { authorization: `Bearer ${token}` },
});
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
429 X_RATE_LIMITED — retry after Retry-After seconds

`listWebhookEndpoints`

GET/v1/list-webhook-endpoints

Firm memberPermission: webhook:manage/v1 · bearer tokenMCP tool: listWebhookEndpoints

The firm's webhook endpoints and their status; never the secret.

Parameters of listWebhookEndpoints
Name	In	Type	Required
`orgId`	Query	`string (uuid)`	Yes
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/v1/list-webhook-endpoints?orgId=<orgId>' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN"

TypeScript

const response = await fetch('https://www.notificado.co/v1/list-webhook-endpoints?orgId=<orgId>', {
  headers: { authorization: `Bearer ${token}` },
});
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
429 X_RATE_LIMITED — retry after Retry-After seconds

GET/_x/query/oauth-consent

Firm memberPermission: or(api-access:write, admin:tokens:self)

oauthConsent

Parameters of oauthConsent
Name	In	Type	Required
`client_id`	Query	`string 1–2000`	No
`code_challenge`	Query	`string 1–2000`	No
`code_challenge_method`	Query	`string 1–2000`	No
`orgId`	Query	`string (uuid)`	Yes
`redirect_uri`	Query	`string 1–2000`	No
`resource`	Query	`string 1–2000`	No
`response_type`	Query	`string 1–2000`	No
`scope`	Query	`string 1–2000`	No
`state`	Query	`string 1–4096`	No
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/_x/query/oauth-consent?orgId=<orgId>' \
  -b cookies.txt

TypeScript

const response = await fetch('https://www.notificado.co/_x/query/oauth-consent?orgId=<orgId>', {
  headers: { cookie: sessionCookie },
});
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
429 X_RATE_LIMITED — retry after Retry-After seconds

`oauthHandoff`

GET/_x/query/oauth-handoff

Firm memberPermission: or(api-access:write, admin:tokens:self)

oauthHandoff

Parameters of oauthHandoff
Name	In	Type	Required
`code`	Query	`string 1–200`	Yes
`orgId`	Query	`string (uuid)`	Yes
`userId`	Query	`string (uuid)`	Yes
`_first`	Query	`integer 1–500`page size; present, the response is the page envelope rather than the bare rows (1 to 500)	No
`_after`	Query	`string`the nextCursor a previous page answered; needs _first	No

curl

curl 'https://www.notificado.co/_x/query/oauth-handoff?code=<code>&orgId=<orgId>&userId=<userId>' \
  -b cookies.txt

TypeScript

const response = await fetch('https://www.notificado.co/_x/query/oauth-handoff?code=<code>&orgId=<orgId>&userId=<userId>', {
  headers: { cookie: sessionCookie },
});
const result = await response.json();

Example response

200

[
  null
]

Errors

400 X_INPUT_INVALID or X_CURSOR_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
429 X_RATE_LIMITED — retry after Retry-After seconds

`authorizeClient`

POST/api/authorize-client

Firm memberPermission: or(api-access:write, admin:tokens:self)

authorizeClient

Parameters of authorizeClient
Name	In	Type	Required
`client_id`	Body	`string 1–100`	Yes
`code`	Body	`string 1–64`	No
`code_challenge`	Body	`string 1–2000`	No
`code_challenge_method`	Body	`string 1–2000`	No
`idle`	Body	`"60"`	No
`orgId`	Body	`string (uuid)`	Yes
`password`	Body	`string 1–1024`	No
`redirect_uri`	Body	`string 1–2000`	Yes
`resource`	Body	`string 1–2000`	No
`response_type`	Body	`string 1–2000`	No
`scope`	Body	`string 1–2000`	No
`scopes`	Body	`string 1–40 \| array of string 1–40`	No
`state`	Body	`string 1–4096`	No

curl

curl -X POST 'https://www.notificado.co/api/authorize-client' \
  -b cookies.txt \
  -H 'origin: https://www.notificado.co' \
  -H 'content-type: application/json' \
  -d '{
  "client_id": "<client_id>",
  "orgId": "<orgId>",
  "redirect_uri": "<redirect_uri>"
}'

TypeScript

const response = await fetch('https://www.notificado.co/api/authorize-client', {
  method: 'POST',
  headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
  body: JSON.stringify({
    "client_id": "<client_id>",
    "orgId": "<orgId>",
    "redirect_uri": "<redirect_uri>"
  }),
});
const result = await response.json();

Example response

200

{
  "redirectTo": "<redirectTo>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`createWebhookEndpoint`

POST/v1/create-webhook-endpoint

Firm memberPermission: webhook:manage/v1 · bearer tokenMCP tool: createWebhookEndpoint

Parameters of createWebhookEndpoint
Name	In	Type	Required
`description`	Body	`string 1–200 \| null`	No
`eventTypes`	Body	`array of string 1–40`	Yes
`orgId`	Body	`string (uuid)`	Yes
`url`	Body	`string 1–2000`	Yes

curl

curl -X POST 'https://www.notificado.co/v1/create-webhook-endpoint' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"eventTypes":["<eventTypes>"],"orgId":"<orgId>","url":"<url>"}'

TypeScript

const response = await fetch('https://www.notificado.co/v1/create-webhook-endpoint', {
  method: 'POST',
  headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
  body: JSON.stringify({
    "eventTypes": [
      "<eventTypes>"
    ],
    "orgId": "<orgId>",
    "url": "<url>"
  }),
});
const result = await response.json();

Example response

200

{
  "endpoint": {
    "createdAt": "<createdAt>",
    "createdAtBogota": "<createdAtBogota>",
    "description": "<description>",
    "disabledAtBogota": "<disabledAtBogota>",
    "eventTypes": [
      "notification.sent"
    ],
    "failureCount": -9007199254740991,
    "id": "<id>",
    "lastFailureAt": "<lastFailureAt>",
    "lastFailureAtBogota": "<lastFailureAtBogota>",
    "lastSuccessAt": "<lastSuccessAt>",
    "lastSuccessAtBogota": "<lastSuccessAtBogota>",
    "rotating": true,
    "status": "active",
    "url": "<url>"
  },
  "secret": "<secret>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`deleteWebhookEndpoint`

POST/v1/delete-webhook-endpoint

Firm memberPermission: webhook:manage/v1 · bearer tokenMCP tool: deleteWebhookEndpoint

Stop sending to an endpoint: pending deliveries are cancelled, the log is kept.

Parameters of deleteWebhookEndpoint
Name	In	Type	Required
`endpointId`	Body	`string (uuid)`	Yes
`orgId`	Body	`string (uuid)`	Yes

curl

curl -X POST 'https://www.notificado.co/v1/delete-webhook-endpoint' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'

TypeScript

const response = await fetch('https://www.notificado.co/v1/delete-webhook-endpoint', {
  method: 'POST',
  headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
  body: JSON.stringify({
    "endpointId": "<endpointId>",
    "orgId": "<orgId>"
  }),
});
const result = await response.json();

Example response

200

{
  "deleted": true,
  "id": "<id>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`issueAgentToken`

POST/api/issue-agent-token

Firm memberPermission: api-access:write

issueAgentToken

Parameters of issueAgentToken
Name	In	Type	Required
`code`	Body	`string 1–64`	No
`expiresOn`	Body	`string`	No
`name`	Body	`string 1–100`	Yes
`orgId`	Body	`string (uuid)`	Yes
`password`	Body	`string 1–1024`	No
`scopes`	Body	`array of string 1–40`	Yes
`ttlDays`	Body	`30 \| 60 \| 90 \| 180 \| 365 \| null`	No

curl

curl -X POST 'https://www.notificado.co/api/issue-agent-token' \
  -b cookies.txt \
  -H 'origin: https://www.notificado.co' \
  -H 'content-type: application/json' \
  -d '{"name":"<name>","orgId":"<orgId>","scopes":["<scopes>"]}'

TypeScript

const response = await fetch('https://www.notificado.co/api/issue-agent-token', {
  method: 'POST',
  headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
  body: JSON.stringify({
    "name": "<name>",
    "orgId": "<orgId>",
    "scopes": [
      "<scopes>"
    ]
  }),
});
const result = await response.json();

Example response

200

{
  "summary": {
    "createdAt": "2026-09-25T15:00:00Z",
    "createdAtBogota": "<createdAtBogota>",
    "expiresAt": "2026-09-25T15:00:00Z",
    "expiresAtBogota": "<expiresAtBogota>",
    "id": "<id>",
    "lastUsedAt": "2026-09-25T15:00:00Z",
    "lastUsedAtBogota": "<lastUsedAtBogota>",
    "name": "<name>",
    "oauthClient": "<oauthClient>",
    "prefix": "<prefix>",
    "revokedAt": "2026-09-25T15:00:00Z",
    "revokedAtBogota": "<revokedAtBogota>",
    "scopes": [
      "cases:read"
    ],
    "status": "active",
    "userId": "<userId>"
  },
  "token": "<token>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`listAgentTokens`

POST/api/list-agent-tokens

Firm memberPermission: api-access:read

listAgentTokens

Parameters of listAgentTokens
Name	In	Type	Required
`orgId`	Body	`string (uuid)`	Yes

curl

curl -X POST 'https://www.notificado.co/api/list-agent-tokens' \
  -b cookies.txt \
  -H 'origin: https://www.notificado.co' \
  -H 'content-type: application/json' \
  -d '{"orgId":"<orgId>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/list-agent-tokens', {
  method: 'POST',
  headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
  body: JSON.stringify({
    "orgId": "<orgId>"
  }),
});
const result = await response.json();

Example response

200

{
  "tokens": [
    {
      "createdAt": "2026-09-25T15:00:00Z",
      "createdAtBogota": "<createdAtBogota>",
      "expiresAt": "2026-09-25T15:00:00Z",
      "expiresAtBogota": "<expiresAtBogota>",
      "id": "<id>",
      "lastUsedAt": "2026-09-25T15:00:00Z",
      "lastUsedAtBogota": "<lastUsedAtBogota>",
      "name": "<name>",
      "oauthClient": "<oauthClient>",
      "prefix": "<prefix>",
      "revokedAt": "2026-09-25T15:00:00Z",
      "revokedAtBogota": "<revokedAtBogota>",
      "scopes": [
        "cases:read"
      ],
      "status": "active",
      "userId": "<userId>"
    }
  ]
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`revokeAgentToken`

POST/api/revoke-agent-token

Firm memberPermission: or(api-access:write, org:read)

revokeAgentToken

Parameters of revokeAgentToken
Name	In	Type	Required
`orgId`	Body	`string (uuid)`	Yes
`returnTo`	Body	`"api" \| "security"`	No
`tokenId`	Body	`string (uuid)`	Yes

curl

curl -X POST 'https://www.notificado.co/api/revoke-agent-token' \
  -b cookies.txt \
  -H 'origin: https://www.notificado.co' \
  -H 'content-type: application/json' \
  -d '{"orgId":"<orgId>","tokenId":"<tokenId>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/revoke-agent-token', {
  method: 'POST',
  headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
  body: JSON.stringify({
    "orgId": "<orgId>",
    "tokenId": "<tokenId>"
  }),
});
const result = await response.json();

Example response

200

{
  "createdAt": "2026-09-25T15:00:00Z",
  "createdAtBogota": "<createdAtBogota>",
  "expiresAt": "2026-09-25T15:00:00Z",
  "expiresAtBogota": "<expiresAtBogota>",
  "id": "<id>",
  "lastUsedAt": "2026-09-25T15:00:00Z",
  "lastUsedAtBogota": "<lastUsedAtBogota>",
  "name": "<name>",
  "oauthClient": "<oauthClient>",
  "prefix": "<prefix>",
  "revokedAt": "2026-09-25T15:00:00Z",
  "revokedAtBogota": "<revokedAtBogota>",
  "scopes": [
    "cases:read"
  ],
  "status": "active",
  "userId": "<userId>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`rotateWebhookSecret`

POST/v1/rotate-webhook-secret

Firm memberPermission: webhook:manage/v1 · bearer tokenMCP tool: rotateWebhookSecret

A new signing secret, shown ONCE; the old one also signs for 24 h.

Parameters of rotateWebhookSecret
Name	In	Type	Required
`endpointId`	Body	`string (uuid)`	Yes
`orgId`	Body	`string (uuid)`	Yes

curl

curl -X POST 'https://www.notificado.co/v1/rotate-webhook-secret' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'

TypeScript

const response = await fetch('https://www.notificado.co/v1/rotate-webhook-secret', {
  method: 'POST',
  headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
  body: JSON.stringify({
    "endpointId": "<endpointId>",
    "orgId": "<orgId>"
  }),
});
const result = await response.json();

Example response

200

{
  "endpoint": {
    "createdAt": "<createdAt>",
    "createdAtBogota": "<createdAtBogota>",
    "description": "<description>",
    "disabledAtBogota": "<disabledAtBogota>",
    "eventTypes": [
      "notification.sent"
    ],
    "failureCount": -9007199254740991,
    "id": "<id>",
    "lastFailureAt": "<lastFailureAt>",
    "lastFailureAtBogota": "<lastFailureAtBogota>",
    "lastSuccessAt": "<lastSuccessAt>",
    "lastSuccessAtBogota": "<lastSuccessAtBogota>",
    "rotating": true,
    "status": "active",
    "url": "<url>"
  },
  "secret": "<secret>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`sendTestWebhook`

POST/v1/send-test-webhook

Firm memberPermission: webhook:manage/v1 · bearer tokenMCP tool: sendTestWebhook

POST a signed webhook.test now; answers the status, duration or failure.

Parameters of sendTestWebhook
Name	In	Type	Required
`endpointId`	Body	`string (uuid)`	Yes
`orgId`	Body	`string (uuid)`	Yes

curl

curl -X POST 'https://www.notificado.co/v1/send-test-webhook' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'

TypeScript

const response = await fetch('https://www.notificado.co/v1/send-test-webhook', {
  method: 'POST',
  headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
  body: JSON.stringify({
    "endpointId": "<endpointId>",
    "orgId": "<orgId>"
  }),
});
const result = await response.json();

Example response

200

{
  "deliveryId": "<deliveryId>",
  "durationMs": -9007199254740991,
  "error": "http_status",
  "ok": true,
  "statusCode": -9007199254740991
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`updateAgentTokenExpiry`

POST/api/update-agent-token-expiry

Firm memberPermission: or(api-access:write, org:manage)

updateAgentTokenExpiry

Parameters of updateAgentTokenExpiry
Name	In	Type	Required
`code`	Body	`string 1–64`	No
`expiresOn`	Body	`string`	No
`lifetime`	Body	`"30" \| "60" \| "90" \| "180" \| "365" \| "never" \| "date"`	Yes
`orgId`	Body	`string (uuid)`	Yes
`password`	Body	`string 1–1024`	No
`tokenId`	Body	`string (uuid)`	Yes

curl

curl -X POST 'https://www.notificado.co/api/update-agent-token-expiry' \
  -b cookies.txt \
  -H 'origin: https://www.notificado.co' \
  -H 'content-type: application/json' \
  -d '{"lifetime":"30","orgId":"<orgId>","tokenId":"<tokenId>"}'

TypeScript

const response = await fetch('https://www.notificado.co/api/update-agent-token-expiry', {
  method: 'POST',
  headers: { 'content-type': 'application/json', origin: 'https://www.notificado.co', cookie: sessionCookie },
  body: JSON.stringify({
    "lifetime": "30",
    "orgId": "<orgId>",
    "tokenId": "<tokenId>"
  }),
});
const result = await response.json();

Example response

200

{
  "createdAt": "2026-09-25T15:00:00Z",
  "createdAtBogota": "<createdAtBogota>",
  "expiresAt": "2026-09-25T15:00:00Z",
  "expiresAtBogota": "<expiresAtBogota>",
  "id": "<id>",
  "lastUsedAt": "2026-09-25T15:00:00Z",
  "lastUsedAtBogota": "<lastUsedAtBogota>",
  "name": "<name>",
  "oauthClient": "<oauthClient>",
  "prefix": "<prefix>",
  "revokedAt": "2026-09-25T15:00:00Z",
  "revokedAtBogota": "<revokedAtBogota>",
  "scopes": [
    "cases:read"
  ],
  "status": "active",
  "userId": "<userId>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

`updateWebhookEndpoint`

POST/v1/update-webhook-endpoint

Firm memberPermission: webhook:manage/v1 · bearer tokenMCP tool: updateWebhookEndpoint

Change url, events or description; pause or resume (resuming delivers what waited).

Parameters of updateWebhookEndpoint
Name	In	Type	Required
`description`	Body	`string 1–200 \| null`	No
`endpointId`	Body	`string (uuid)`	Yes
`eventTypes`	Body	`array of string 1–40`	No
`orgId`	Body	`string (uuid)`	Yes
`state`	Body	`"active" \| "paused"`	No
`url`	Body	`string 1–2000`	No

curl

curl -X POST 'https://www.notificado.co/v1/update-webhook-endpoint' \
  -H "authorization: Bearer $NOTIFICADO_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"endpointId":"<endpointId>","orgId":"<orgId>"}'

TypeScript

const response = await fetch('https://www.notificado.co/v1/update-webhook-endpoint', {
  method: 'POST',
  headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
  body: JSON.stringify({
    "endpointId": "<endpointId>",
    "orgId": "<orgId>"
  }),
});
const result = await response.json();

Example response

200

{
  "createdAt": "<createdAt>",
  "createdAtBogota": "<createdAtBogota>",
  "description": "<description>",
  "disabledAtBogota": "<disabledAtBogota>",
  "eventTypes": [
    "notification.sent"
  ],
  "failureCount": -9007199254740991,
  "id": "<id>",
  "lastFailureAt": "<lastFailureAt>",
  "lastFailureAtBogota": "<lastFailureAtBogota>",
  "lastSuccessAt": "<lastSuccessAt>",
  "lastSuccessAtBogota": "<lastSuccessAtBogota>",
  "rotating": true,
  "status": "active",
  "url": "<url>"
}

Errors

400 X_INPUT_INVALID
401 X_UNAUTHENTICATED — no credential, or one that did not resolve
403 policy denied
422 X_BODY_INVALID
429 X_RATE_LIMITED — retry after Retry-After seconds

Preferences

Language

Appearance

Agent tokens

`listWebhookDeliveries`

`listWebhookEndpoints`

`oauthHandoff`

`authorizeClient`

`createWebhookEndpoint`

`deleteWebhookEndpoint`

`issueAgentToken`

`listAgentTokens`

`revokeAgentToken`

`rotateWebhookSecret`

`sendTestWebhook`

`updateAgentTokenExpiry`

`updateWebhookEndpoint`