> ## Documentation Index > Fetch the complete documentation index at: https://docs.appgoat.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create webhook > `kind`: - `webhook` (default): POST of the event JSON, signed with `appgoat-signature: t=,v1=.")>`. The `secret` is returned once, here (rotate with PATCH rotate_secret). Answer 2xx within 10 s. - `slack`: `url` is a Slack incoming webhook (https://hooks.slack.com/services/…). - `github`: `url` is `owner/repo`, `github_token` a fine-grained token with Contents: read and write on it. Sends `{ event_type: "appgoat.", client_payload: }` to start a workflow `on: repository_dispatch`. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h, 12 h and 24 h; an endpoint failing 50 times in a row is disabled (PATCH active=true re-enables it). Free plan: 402 plan_limit (use GET /v1/events). ## OpenAPI ````yaml openapi.json POST /webhooks openapi: 3.1.0 info: title: AppGoat API version: 1.0.0 summary: App Store + Google Play data for agents and apps. description: > Every app and developer in both stores, daily top charts, reviews, change feeds, metric history and keyword (search-rank) intelligence. **Conventions** - `{app}` accepts anything that identifies an app: an App Store id (`284882215`, `id284882215`), a Play package (`com.spotify.music`), an Apple bundle id (`com.spotify.client`), a store URL, `apple:` / `play:`, or a name (`spotify` → best match, with a warning in `meta.warnings`). Add `store=apple|play` to disambiguate. `data.linked` is the same app in the other store when we know it. - Freshness is automatic: app-scoped reads refresh data older than `max_age` seconds from the store first (1 credit per country fetched, capped at 10). `wait=true` (default) blocks up to ~25 s; on timeout, or with `wait=false`, you get the cached data with `meta.freshness.refreshing: true` and a `job_id` to poll at `GET /v1/jobs/{id}` (free). - `country` defaults to `us`; pass a comma list (paid plans) or `all` (Studio). - `include=` adds sections, `fields=` keeps only the listed top-level fields, lists page with `cursor` (pass `meta.next_cursor` back unchanged). - Every success is `{ data, meta }`; `meta.credits_used` is what the call cost and `meta.credits_remaining` what is left. Errors are `{ error: { code, message, hint, docs } }`: read `hint`, it says what to do next. - `x-credits` on each operation documents its price. - Watches turn store changes into events: `POST /v1/watches`, then poll `GET /v1/events` or add a webhook (`POST /v1/webhooks`). Watches, events and webhooks are free; only the plan's watched-app and keyword-slot limits apply. `/v1/tracked-keywords` is deprecated: use keyword watches. contact: email: support@appgoat.ai url: https://appgoat.ai servers: - url: https://api.appgoat.ai/v1 security: - apiKey: [] tags: - name: Apps - name: Search & charts - name: Keywords - name: Developers - name: Audits - name: Watches & events description: >- Watch apps, competitors and keywords; significant changes become events (feed, webhooks, Slack, GitHub, daily email digest). - name: Webhooks - name: Connections - name: Actions - name: Jobs - name: Account paths: /webhooks: post: tags: - Webhooks summary: >- Send events to a URL, a Slack channel or a GitHub repository (repository_dispatch) as they happen (paid plans). description: > `kind`: - `webhook` (default): POST of the event JSON, signed with `appgoat-signature: t=,v1=.")>`. The `secret` is returned once, here (rotate with PATCH rotate_secret). Answer 2xx within 10 s. - `slack`: `url` is a Slack incoming webhook (https://hooks.slack.com/services/…). - `github`: `url` is `owner/repo`, `github_token` a fine-grained token with Contents: read and write on it. Sends `{ event_type: "appgoat.", client_payload: }` to start a workflow `on: repository_dispatch`. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h, 6 h, 12 h and 24 h; an endpoint failing 50 times in a row is disabled (PATCH active=true re-enables it). Free plan: 402 plan_limit (use GET /v1/events). operationId: createWebhook requestBody: required: true content: application/json: schema: type: object required: - url properties: url: type: string description: >- https URL (webhook), Slack incoming webhook URL (slack) or owner/repo (github). kind: type: string enum: - webhook - slack - github default: webhook event_types: type: - array - 'null' items: $ref: '#/components/schemas/EventType' description: null = every type. description: type: - string - 'null' github_token: type: string description: kind github only; never returned. examples: webhook: value: url: https://example.com/hooks/appgoat event_types: - new_version - rating_drop github: value: kind: github url: acme/my-app github_token: github_pat_xxx event_types: - negative_review_spike responses: '201': description: The endpoint, with its signing `secret` (only now). content: application/json: schema: allOf: - $ref: '#/components/schemas/Envelope' - properties: data: $ref: '#/components/schemas/WebhookEndpoint' '400': $ref: '#/components/responses/InvalidParam' '402': $ref: '#/components/responses/PaymentRequired' components: schemas: EventType: type: string enum: - new_version - metadata_change - price_change - featured - in_app_event - installs_milestone - rating_drop - ratings_spike - review_spike - negative_review_spike - chart_enter - chart_leave - rank_change - keyword_entrant description: > App / competitor_set watches: `new_version` (version + release notes), `metadata_change` (title, subtitle, description, screenshots, icon, category…; `payload.changes`), `price_change` (price or in-app purchases), `featured` (Editors' Choice, featuring, badges), `in_app_event`, `installs_milestone` (Play install bucket), `rating_drop` (7-day drop ≥ settings.rating_drop), `ratings_spike` / `review_spike` (day count ≥ settings.spike_factor × the 14-day average), `negative_review_spike` (negative reviews per topic), `chart_enter` / `chart_leave` (crossing the top settings.chart_top_n). Keyword watches: `rank_change` (the watch's app moved ≥ settings.rank_move, or entered / left the ranking), `keyword_entrant` (new apps in the top settings.keyword_top_n). Envelope: type: object required: - data - meta properties: data: {} meta: $ref: '#/components/schemas/Meta' WebhookEndpoint: type: object properties: id: type: integer kind: type: string enum: - webhook - slack - github url: type: string description: 'github: owner/repo; slack: shortened (the URL is a credential).' description: type: - string - 'null' event_types: type: - array - 'null' items: $ref: '#/components/schemas/EventType' active: type: boolean disabled_reason: type: - string - 'null' failure_count: type: integer description: Consecutive failed attempts. last_success_at: type: - string - 'null' format: date-time last_failure_at: type: - string - 'null' format: date-time secret: type: string description: >- kind webhook: the signing secret, only in the create / rotate response. secret_hint: type: string created_at: type: string format: date-time updated_at: type: string format: date-time Meta: type: object properties: credits_used: type: integer credits_remaining: type: integer description: Added by the gateway. request_id: type: string description: Added by the gateway. freshness: $ref: '#/components/schemas/Freshness' next_cursor: type: - string - 'null' store: $ref: '#/components/schemas/Store' warnings: type: array items: type: string description: Things to know (e.g. "resolved by name"); safe to show to the user. Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string enum: - invalid_param - invalid_credentials - unauthorized - forbidden - insufficient_credits - plan_limit - free_audit_used - not_found - app_not_found - developer_not_found - job_not_found - conflict - not_ready - rate_limited - provider_error - internal_error - not_configured message: type: string hint: type: string description: What to do next. docs: type: string format: uri param: type: string Freshness: type: object properties: fetched_at: type: - string - 'null' format: date-time description: When the oldest requested country was last fetched from the store. age_seconds: type: - integer - 'null' stale: type: boolean description: Older than max_age (or missing). refreshing: type: boolean description: A store fetch is still running; poll job_id. job_id: type: - string - 'null' Store: type: string enum: - apple - play responses: InvalidParam: description: A parameter is missing or invalid (`error.param` names it). content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: invalid_param message: limit must be ≤ 100 hint: Fix the parameter and retry. docs: https://appgoat.ai/docs/errors#invalid_param param: limit PaymentRequired: description: >- `insufficient_credits` (the call costs more than you have left; nothing was done) or `plan_limit` (a feature of a higher plan). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: apiKey: type: apiKey in: header name: x-api-key description: Create a key at https://dash.appgoat.ai. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.