Hooklane API Reference

Webhook delivery you can audit

Send events. Prove they arrived.

Hooklane sits between your product's events and your customers' endpoints: subscriptions, signed deliveries, automatic retries with backoff, and a delivery log you can query. This reference documents the full v1 surface — four endpoints, JSON over HTTPS, no SDK required.

https://api.hooklane.example 4 endpoints JSON over HTTPS
Browse endpoints Open the request builder
First request 
curl -X GET \
  'https://api.hooklane.example/v1/deliveries' \
  -G \
  --data-urlencode 'subscription_id=sub_9f2c1a' \
  --data-urlencode 'status=failed' \
  --data-urlencode 'limit=25' \
  --data-urlencode 'since=2026-08-01T00:00:00Z' \
  -H "Authorization: Bearer $HOOKLANE_API_KEY"

Assembled by this reference — nothing runs in the browser.

Endpoints

Four calls cover the surface: read the delivery log, then create, update, or delete subscriptions. Every page below has a request builder wired to the parameter list.

Deliveries

Subscriptions

Authentication

Every request is authenticated with a secret API key sent in the Authorization header. Keys are scoped per environment: hk_live_ keys touch production subscriptions, hk_test_ keys only ever deliver to test endpoints.

Examples keep the key as a $HOOKLANE_API_KEY shell variable — export it once and every copied command works as-is. Your key stays in your terminal: this reference never asks for it and never sends a request.

request header 
Authorization: Bearer $HOOKLANE_API_KEY

# once per shell:
export HOOKLANE_API_KEY="hk_test_your_key_here"

How the request builder works

  1. Pick an endpoint

    Each page documents one call: every parameter with its type and an honest example, plus the exact response shape.

  2. Fill in the form

    The curl command rewrites itself as you type — correct method, headers, query string, and JSON body, with shell quoting handled for you.

  3. Copy and run it

    The copy button grabs exactly what you see. Nothing is sent from the page — the request runs in your terminal, on your keys.

Questions, answered

The short version of what developer support gets asked most.

Does the try-it panel call the API?

No. The panel assembles a curl command from the endpoint definition and your inputs, and the copy button copies exactly what you see. Nothing is ever sent from this page — you stay in control of when and where the request runs.

Where do I get an API key?

Keys are created in the Hooklane dashboard under Settings → API keys. Live keys start with hk_live_, test keys with hk_test_. The reference examples read the key from a $HOOKLANE_API_KEY shell variable, so export it once and every copied command works unchanged.

How are deliveries signed?

Every delivery carries an X-Hooklane-Signature header: an HMAC-SHA256 of the raw request body, keyed with the subscription's signing secret (the whsec_ value returned when you create the subscription). Verify it before trusting a payload, and rotate the secret by recreating the subscription.

What happens when an endpoint is down?

Hooklane retries failed deliveries with exponential backoff — eight attempts spread over roughly 24 hours. Each attempt is a row in the delivery log with the response code we saw, so GET /v1/deliveries?status=failed shows you exactly what still needs attention.

Can I test without touching production?

Yes. Requests made with an hk_test_ key operate on an isolated set of subscriptions and deliveries. The API surface is identical, so every command in this reference behaves the same in test mode.

Still stuck?

Stuck on a delivery you can't explain? Send the delivery id and we'll trace it.

Email Hooklane developer support