Workspace

Create workspace webhook

Workspace webhooks — the same registry as /v1/phone-lines/webhooks (same rows, plwh_ secret, signature, retries and deliveries), with a wider event set: every phone_line.* event plus wallet.topup_paid (a wallet top-up was credited). "*" means every phone-line event only: wallet.topup_paid is opt-in, list it by name (for example ["*", "wallet.topup_paid"]). This surface lists every webhook of the workspace. Tenant-scoped key (or account key with x-workspace-id); Owner or Admin (phone_lines:webhooks) with a user credential.

⚠️ Real side effect — this is NOT a simulation, including from the playground. Creates a phone-line webhook and answers 201 with { "webhook": { … } }, including secret — the plwh_… signing secret. This is the only time it is ever returned: store it right away (the response is sent with Cache-Control: no-store). There is no rotation: to change it, create a new webhook, move your receiver to its secret, and delete the old one.

Not idempotent: two calls create two webhooks, each with its own secret. A workspace can have more than one phone-line webhook; each receives the events it subscribed to. Events are never replayed to a webhook created after them.

Permissions: with an OAuth / MCP token, the user must be an Owner or Admin (phone_lines:webhooks) — 403 PERMISSION_DENIED otherwise.

Every /v1/phone-lines endpoint takes a tenant-scoped key only: phone-line webhooks belong to the workspace, not to a WhatsApp number, so a number-scoped key (or a per-number OAuth grant) gets 403 NUMBER_SCOPE_NOT_ALLOWED before any role is looked at. A 403 PERMISSION_DENIED / WORKSPACE_MEMBERSHIP_REQUIRED is sent with Cache-Control: no-store.

These are the phone-line webhooks — a registry separate from /v1/webhooks: they receive only phone_line.* events, and a number webhook never receives one.

Requires a tenant-scoped key.

POST

workspace

webhooks

Create a workspace webhook

curl --request POST \
  --url https://pilotstatus.com.br/v1/workspace/webhooks \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "url": "https://hooks.example.com/pilot/phone-lines",
  "events": [
    "*"
  ]
}
'

import requests

url = "https://pilotstatus.com.br/v1/workspace/webhooks"

payload = {
    "url": "https://hooks.example.com/pilot/phone-lines",
    "events": ["*"]
}
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({url: 'https://hooks.example.com/pilot/phone-lines', events: ['*']})
};

fetch('https://pilotstatus.com.br/v1/workspace/webhooks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://pilotstatus.com.br/v1/workspace/webhooks",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => 'https://hooks.example.com/pilot/phone-lines',
    'events' => [
        '*'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://pilotstatus.com.br/v1/workspace/webhooks"

	payload := strings.NewReader("{\n  \"url\": \"https://hooks.example.com/pilot/phone-lines\",\n  \"events\": [\n    \"*\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://pilotstatus.com.br/v1/workspace/webhooks")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"url\": \"https://hooks.example.com/pilot/phone-lines\",\n  \"events\": [\n    \"*\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://pilotstatus.com.br/v1/workspace/webhooks")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"url\": \"https://hooks.example.com/pilot/phone-lines\",\n  \"events\": [\n    \"*\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "webhook": {
    "id": "cmh1w8b2k0001wh8example3d",
    "name": "hooks.example.com",
    "url": "https://hooks.example.com/pilot/phone-lines",
    "events": [
      "*"
    ],
    "active": true,
    "secret": "plwh_3f9c1a7e5b2d4c6e8a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d",
    "createdAt": "2026-10-27T13:58:02.000Z"
  }
}

This creates a real webhook, and events start going to its URL right away. The response carries the plwh_ signing secret only this once. See Workspace webhooks.

Authorizations

x-api-key

string

header

required

Your ps_ API key

Headers

x-workspace-id

string

Only with an account key (ps_account_): the workspace to act on, from GET /v1/workspaces. Without it an account key gets 400 WORKSPACE_ID_REQUIRED.

Body

application/json

url

string

required

Must be https and reach a public address. A URL that points to an internal or private network address — localhost, a loopback or private IP, a host without a dot, or a name that resolves to one — → 400 WEBHOOK_URL_REFUSED.

Example:

"https://hooks.example.com/pilot/phone-lines"

events

enum<string>[]

required

One or more of the phone-line events, or "*" for all of them (inside this registry "*" means every phone-line event, including any added later). Duplicates are removed. An empty list or an unknown event → 400 INVALID_WEBHOOK.

Minimum array length: 1

Available options:

phone_line.purchased,

phone_line.audio_received,

phone_line.code_received,

phone_line.code_failed,

phone_line.renewed,

phone_line.payment_failed,

phone_line.suspended,

phone_line.returned,

phone_line.canceled,

phone_line.verification_updated,

*

Example:

["*"]

name

string

Optional, up to 100 characters (400 INVALID_WEBHOOK_NAME above that). Blank or absent → the URL's host.

Maximum string length: 100

Example:

"Phone lines — production"

Response

Created — secret is returned only this once

webhook

object

Show child attributes

Create a workspace webhook

curl --request POST \
  --url https://pilotstatus.com.br/v1/workspace/webhooks \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "url": "https://hooks.example.com/pilot/phone-lines",
  "events": [
    "*"
  ]
}
'

import requests

url = "https://pilotstatus.com.br/v1/workspace/webhooks"

payload = {
    "url": "https://hooks.example.com/pilot/phone-lines",
    "events": ["*"]
}
headers = {
    "x-api-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({url: 'https://hooks.example.com/pilot/phone-lines', events: ['*']})
};

fetch('https://pilotstatus.com.br/v1/workspace/webhooks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://pilotstatus.com.br/v1/workspace/webhooks",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => 'https://hooks.example.com/pilot/phone-lines',
    'events' => [
        '*'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-api-key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://pilotstatus.com.br/v1/workspace/webhooks"

	payload := strings.NewReader("{\n  \"url\": \"https://hooks.example.com/pilot/phone-lines\",\n  \"events\": [\n    \"*\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-api-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://pilotstatus.com.br/v1/workspace/webhooks")
  .header("x-api-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"url\": \"https://hooks.example.com/pilot/phone-lines\",\n  \"events\": [\n    \"*\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://pilotstatus.com.br/v1/workspace/webhooks")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"url\": \"https://hooks.example.com/pilot/phone-lines\",\n  \"events\": [\n    \"*\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "webhook": {
    "id": "cmh1w8b2k0001wh8example3d",
    "name": "hooks.example.com",
    "url": "https://hooks.example.com/pilot/phone-lines",
    "events": [
      "*"
    ],
    "active": true,
    "secret": "plwh_3f9c1a7e5b2d4c6e8a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d",
    "createdAt": "2026-10-27T13:58:02.000Z"
  }
}