Webhook IP API

API reference

Webhook IP HTTP endpoints on api.syndaq.com.

All Webhook IP endpoints are served from https://api.syndaq.com/v1/webhookip/.

Authenticated requests require a valid Webhook IP key. Lookup routes require your wk_sec_ secret key.

Endpoints overview

Method	Path	Auth	Purpose
GET	`/v1/webhookip/lookup`	Secret key	Lookup by `?ip=` (optional `?provider=`)
GET	`/v1/webhookip/lookup/{ip}`	Secret key	Lookup by IP in the URL path
GET	`/v1/webhookip/status`	Public or secret key	Plan limits and quota snapshot

Response headers

Successful and error responses may include:

Header	Description
`X-Request-Id`	Unique ID for support and log correlation
`X-RateLimit-Limit`	Plan requests per minute for this key
`X-RateLimit-Remaining`	Requests left in the current minute window
`X-RateLimit-Reset`	Unix timestamp when the minute window resets
`X-Quota-Limit`	Monthly quota for the subscription
`X-Quota-Remaining`	Lookups left this calendar month (UTC)
`X-Quota-Period`	Current quota month (`YYYY-MM`)
`Retry-After`	Seconds to wait after HTTP 429

GET /v1/webhookip/lookup

Checks whether a public IP matches Syndaq-maintained webhook provider ranges.

Request

Pass the target IP using one of these forms:

GET /v1/webhookip/lookup/140.82.112.1
GET /v1/webhookip/lookup?ip=140.82.112.1
GET /v1/webhookip/lookup?ip=140.82.112.1&provider=github

Headers:

Authorization: Bearer wk_sec_YOUR_SECRET_KEY

v1 scope

v1 performs range matching against Syndaq's webhook provider list (for example GitHub, Stripe, Slack, and other maintained senders). Coverage may expand over time. Use alongside provider signature verification when the sender supports it.

Success response (200)

{
  "success": true,
  "ip": "140.82.112.1",
  "cached": true,
  "matched": true,
  "providers": [
    { "id": "github", "name": "GitHub" }
  ],
  "request_id": "e6d04020be9b57b1e1069d6e483c0443"
}

When no provider matches:

{
  "success": true,
  "ip": "203.0.113.10",
  "cached": true,
  "matched": false,
  "providers": [],
  "request_id": "e6d04020be9b57b1e1069d6e483c0443"
}

Response fields

Field	Type	Description
`ip`	string	Normalized IP address that was checked
`cached`	boolean	`true` when Syndaq already holds a recent result for this lookup
`matched`	boolean	`true` if the IP falls in at least one known webhook range
`providers`	array	Matching providers (`id`, `name`)

GET /v1/webhookip/status

Returns key status, plan limits, and quota usage without performing a lookup.

Request

GET /v1/webhookip/status
Authorization: Bearer wk_sec_YOUR_SECRET_KEY

The public key (wk_pub_) is accepted on this route.

Success response (200)

{
  "success": true,
  "status": "active",
  "product": "webhookip",
  "plan": "starter",
  "rate_limit_per_minute": 120,
  "monthly_quota": 10000,
  "quota_unlimited": false,
  "quota_remaining": 9912,
  "quota_period": "2026-07"
}

Errors

Failed requests return JSON with success: false, error, error_code, and usually request_id.

HTTP	error_code	Typical cause
400	`invalid_ip`	Missing or malformed IP address
401	`missing_credentials`	No API key provided
401	`invalid_api_key`	Unknown, inactive, or revoked key
401	`wrong_key_type`	Public key used on a lookup endpoint
403	`ip_not_allowed`	Caller IP not on the key allowlist
422	`ip_not_routable`	Private, reserved, or unsupported address
429	`rate_limit_exceeded`	Per-minute limit exceeded
429	`quota_exceeded`	Monthly quota exhausted
500	`internal_error`	Unexpected server error

Handle non-200 responses in your application and retry transient errors with exponential backoff.