Webhook: a tool call ended
Sent to the webhook URL of a call when it ends, signed the Standard Webhooks way: verify webhook-signature against "{webhook-id}.{webhook-timestamp}.{raw body}" with HMAC-SHA256 and your secret, before trusting the body. Answer with any 2xx within 10 seconds. Other answers are retried for about 16 hours; 410 Gone stops retries. The same webhook-id can arrive more than once: ignore duplicates.
Authorizations
A workspace API key from Settings → Developers → API keys, sent as Authorization: Bearer sk_… (or X-API-Key: sk_…). It acts as one workspace member and uses the workspace's credits.
Headers
The event id. The same on every retry of this event.
When this attempt was signed, in Unix seconds. Reject events more than 5 minutes off.
Space-separated v1,<base64 HMAC-SHA256> signatures, one per valid secret.
Body
Same as the webhook-id header.
tool_invocation.completed, tool_invocation.not_executed, tool_invocation.unknown_outcome The operation, exactly as GET /api/tool-invocations/{invocationId} returns it (without replayed and chargedThisRequest).
Response
Received. Any 2xx counts.