Skip to content
CCS Files Docs

Set the webhook

PUT
/api/v1/tenants/{tenant_id}/applications/{application_id}/webhooks
curl --request PUT \
  --url https://files.centralcodestation.com/api/v1/tenants/example/applications/example/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "url": "https://api.example.com/hooks/files", "secret": "example", "events": [ "file.ready", "file.failed" ], "active": true }'

One webhook per application. An active webhook is first sent a signed ping event: unless it answers 2xx within the timeout (5 s by default), nothing is saved and the answer is 422 webhook_unreachable. Leave secret out to keep the stored one. Audited webhook.updated (never the secret).

Webhooks

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
tenant_id
required
string

The Identity Server tenant id.

application_id
required
string

The Identity Server application id: a tenant application, or (platform clients) the client’s own platform application.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
url
required

Https in production; no credentials; not a private, loopback or link-local address.

string
<= 2048 characters

Example 

https://api.example.com/hooks/files
secret

Signs every delivery (X-Files-Signature). Write-only, stored encrypted, never returned. Required the first time; leave it out to keep the stored one.

string
>= 16 characters <= 256 characters
events
required
Array<string>
Allowed values: file.ready file.failed file.quarantined file.status.changed file.shared file.version.created file.lock.changed folder.changed

Example 

[
  "file.ready",
  "file.failed"
]
active

An active webhook is pinged before it is saved; false stops deliveries without a ping.

boolean
default: true

Responses

Section titled “Responses”

200

Section titled “200”

Success.

Media typeapplication/json
object
url
required

Null when no webhook is set.

string
nullable
events
required
Array<string>
active
required

False when switched off, or after 20 consecutive failed deliveries.

boolean
secret_set
required

Whether a secret is stored (the secret itself is never returned).

boolean
consecutive_failures
required

Consecutive events whose every attempt failed; 20 switch the webhook off. Reset by a delivery or a PUT.

number
last_delivery_at
required
string format: date-time
nullable
disabled_at
required

When the failures switched it off.

string format: date-time
nullable
updated_at
required
string format: date-time
nullable

Example 

{
  "url": "https://api.example.com/hooks/files",
  "events": [
    "file.ready",
    "file.failed"
  ]
}

400

Section titled “400”

Error. error is one of: invalid_request, webhook_url_not_allowed.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 400,
  "error": "invalid_request",
  "message": "The request is malformed: a required field is missing, a value has the wrong type or format, or a field the route does not accept was sent",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

401

Section titled “401”

Error. error is one of: invalid_token.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 401,
  "error": "invalid_token",
  "message": "The bearer token is missing, malformed, expired, signed by an unknown key, or has the wrong audience (`aud` must be `files-api`).",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

403

Section titled “403”

Error. error is one of: not_tenant_member, no_application_access, tenant_not_available, insufficient_scope, client_context_mismatch, files_access_not_granted, missing_capability.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 403,
  "error": "not_tenant_member",
  "message": "The user is not an active member of the tenant in the URL.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

404

Section titled “404”

Error. error is one of: application_not_found, not_found.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 404,
  "error": "application_not_found",
  "message": "The application in the URL is not an active application of the tenant.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

422

Section titled “422”

Error. error is one of: webhook_unreachable.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 422,
  "error": "webhook_unreachable",
  "message": "The webhook URL did not answer the verification ping with a 2xx within 5 seconds.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

429

Section titled “429”

Error. error is one of: rate_limited.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 429,
  "error": "rate_limited",
  "message": "Too many requests in the current window; `retry_after` (and the `Retry-After` header) says when to retry.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

503

Section titled “503”

Error. error is one of: identity_unavailable.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 503,
  "error": "identity_unavailable",
  "message": "The service could not reach the Identity Server and has no fresh cached answer.",
  "path": "/api/v1/tenants/fitness-co/applications/fitness-app/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D",
  "timestamp": "2026-10-22T09:12:33.120Z"
}

default

Section titled “default”

Error: see error for the code.

Media typeapplication/json
object
status_code
required
number
error
required

Stable snake_case error code.

string
Allowed values: invalid_request invalid_cursor invalid_limit invalid_json invalid_name depth_exceeded invalid_move role_locked invalid_redirect_uri invalid_id_token webhook_url_not_allowed invalid_grant invalid_token share_password_required insufficient_scope not_tenant_member no_application_access tenant_not_available client_context_mismatch principal_not_allowed files_access_not_granted missing_capability missing_action platform_admin_required tenant_suspended partial_permission cannot_grant_more_than_held tenant_owner_required folder_managed share_password_invalid not_found application_not_found role_not_found file_not_found folder_not_found upload_not_found version_not_found share_not_found entry_not_found rendition_not_available job_not_found taxonomy_not_found upload_expired upload_not_open name_conflict scan_pending file_quarantined file_trashed file_pending file_locked file_on_hold status_locked version_is_current folder_busy idempotency_key_reused share_gone share_limit_reached revision_mismatch file_too_large quota_exceeded payload_too_large upload_incomplete size_mismatch hash_mismatch type_not_allowed not_previewable too_many_entries too_many_file_ids too_many_scopes too_many_applications taxonomy_value_invalid public_visibility_disabled share_links_disabled webhook_unreachable rate_limited server_error not_implemented identity_unavailable storage_unavailable notifications_unavailable storage_account_not_found storage_migration_not_found storage_account_in_use storage_account_not_verified storage_migration_in_progress storage_account_verification_failed storage_adapter_not_allowed
message
required
One of:
string
path
required
string
timestamp
required
string format: date-time

Example 

{
  "status_code": 403,
  "error": "invalid_request",
  "message": "This client is not bound to this tenant/application",
  "path": "/api/v1/tenants/t1/applications/a1/files/01J9Z6S9Q5F5R6Y2W2GZ3B3K4D"
}