# FieldRobin webhook integration guide

FieldRobin supports authenticated, workspace-scoped outbound webhooks for integrations. Webhook configuration is not public data and requires a signed-in workspace API token.

## API resources

- List endpoints: GET https://fieldrobin.com/api/v1/webhook-endpoints
- Create an endpoint: POST https://fieldrobin.com/api/v1/webhook-endpoints
- Test delivery: POST https://fieldrobin.com/api/v1/webhook-endpoints/{id}/test
- Update or delete: PATCH or DELETE https://fieldrobin.com/api/v1/webhook-endpoints/{id}
- Rotate a secret: POST https://fieldrobin.com/api/v1/webhook-endpoints/{id}/rotate-secret
- [OpenAPI document](https://fieldrobin.com/openapi.json)

## Delivery verification

FieldRobin signs outbound webhook payloads with the endpoint secret. Verify the `X-FieldRobin-Signature` header against the exact raw request body before processing an event. Keep secrets outside logs, rotate them when exposure is suspected, and make event handling idempotent because delivery can be retried.

Webhook endpoints are tenant-scoped. Do not accept an endpoint identifier, event, or payload as proof of workspace authorization; authenticate the API request and verify the signature independently.

- [Developer resources](https://fieldrobin.com/developers)
- [API versioning policy](https://fieldrobin.com/api-versioning.md)
- [Contact FieldRobin](https://fieldrobin.com/contact)