Endpoint URLs

An endpoint URL turns each JSON event a service sends into a note in one thread: form answers, alerts, build results, GitHub pull requests or Slack messages. The service needs no token and no code from you, only the URL.

What an endpoint URL is

• The URL is the credential. Anyone who has it can add notes to its thread, so keep it like a password.
• It adds notes to the one thread the owner chose. An event can’t choose another thread.
• The owner creates it in ThreadPage, as a connection of its own on Add only. The API can’t create one.
• It needs Pro with Sync turned on. Without them, events answer 409 and are not added.
• The URL, and its secret if it has one, are shown once. Replace URL… gives new ones, and the old ones stop working at once.
• It needs no permission for a shared thread: the owner chose that thread.
• A connection has up to 10 endpoint URLs.

To create one: in Settings → Connections, go to Automations and choose Connect an automation → Add notes from another app. Choose the thread and what the service sends, then copy the URL and any secret into the service.

Presets

Send an event

With Text or Markdown, send text (kept as written) or markdown (formatted). An id makes a retried event count once:

curl -X POST "$THREADPAGE_ENDPOINT_URL" \
  -H "Content-Type: application/json" \
  -d '{"text": "Build 412 passed."}'

curl -X POST "$THREADPAGE_ENDPOINT_URL" \
  -H "Content-Type: application/json" \
  -d '{"id": "build-412", "markdown": "**Build 412** passed. [Logs](https://ci.example.com/412)"}'

{"outcome": "accepted", "note_id": "4c2f8e19-7a6b-4d3e-b1c0-95e8f2a7d364", "diagnostic_id": "5b3e9a0c7d1f4e2a8b6c0d9e1f2a3b4c"}

Send an event to an endpoint URL

POST /in/{capability}

The owner adds an endpoint URL to a custom connection whose level adds notes (Add only, Read and add or Edit and organize) in Settings → Connections; each event becomes a note in the one thread they chose. The URL is the credential: no token is sent, and it is shown once. Signed endpoints check the signature over the raw body first (Standard Webhooks, GitHub X-Hub-Signature-256 or Slack v0, within five minutes). The preset decides which events become notes and how a repeated event is recognised for 30 days: the webhook-id header where nothing is signed or a Standard Webhooks signature covers it; otherwise the event's id in the body (id; event_id for Slack, whose signature covers the body only, so its webhook-id header is ignored), and for GitHub the SHA-256 of the signed body. Every answer except Slack's URL check has outcome and diagnostic_id, which is also the X-Request-ID header; an added note has its note_id.

Answer 200: Slack's URL check, answered with its challenge.

curl -m 30 -X POST "$ENDPOINT_URL" \
  -H "Content-Type: application/json" \
  -d '{"id":"build-412","markdown":"**Build 412** passed on `main`."}'

Errors: reconnect_required 403, 409, write_not_allowed 403, 409, not_found 404, connection_unavailable 409, invalid_json 400, content_too_large 413, unsupported_media_type 415, thread_archived 409, invalid_signature 401, secret_unavailable 401, method_not_allowed 405, endpoint_paused 503, missing_field 422, empty_note 422.

Template syntax

A template is Markdown with fields from the event, written as JSON Pointers in double braces.

Other values are inserted as plain text, and null inserts nothing. The dialog in ThreadPage previews the note from a sample event.

New lead: **{{/name}}**
{{/company?}}
{{/profile|url}}
Received {{/created_at|timestamp}}

An event that lacks a required field answers 422.

Signing

An endpoint can require a signature over the raw body, checked before anything is parsed. A timestamp must be within 5 minutes.

A Standard Webhooks request, signed the way ThreadPage signs its own webhooks:

import crypto from 'node:crypto';

const secret = process.env.THREADPAGE_ENDPOINT_SECRET; // whsec_…
const body = JSON.stringify({ id: 'build-412', markdown: '**Build 412** passed.' });
const id = `msg_${crypto.randomUUID()}`; // one per event, the same when you retry it
const timestamp = String(Math.floor(Date.now() / 1000));
const key = Buffer.from(secret.slice('whsec_'.length), 'base64');
const signature = crypto.createHmac('sha256', key).update(`${id}.${timestamp}.${body}`).digest('base64');

const answer = await fetch(process.env.THREADPAGE_ENDPOINT_URL, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'webhook-id': id,
    'webhook-timestamp': timestamp,
    'webhook-signature': `v1,${signature}`,
  },
  body,
});
console.log(answer.status, await answer.json());

import base64, hashlib, hmac, json, os, time, uuid
import requests  # pip install requests

secret = os.environ["THREADPAGE_ENDPOINT_SECRET"]  # whsec_…
body = json.dumps({"id": "build-412", "markdown": "**Build 412** passed."}).encode()
message_id = f"msg_{uuid.uuid4()}"  # one per event, the same when you retry it
timestamp = str(int(time.time()))
key = base64.b64decode(secret.removeprefix("whsec_"))
signature = base64.b64encode(hmac.new(key, f"{message_id}.{timestamp}.".encode() + body, hashlib.sha256).digest()).decode()

answer = requests.post(
    os.environ["THREADPAGE_ENDPOINT_URL"],
    data=body,
    headers={
        "Content-Type": "application/json",
        "webhook-id": message_id,
        "webhook-timestamp": timestamp,
        "webhook-signature": f"v1,{signature}",
    },
    timeout=30,
)
print(answer.status_code, answer.json())

Duplicates

ThreadPage remembers an event for 30 days and adds it once:

• by its webhook-id, when the endpoint is unsigned or a Standard Webhooks signature covers it;
• otherwise by the event’s own ID: id in the body, or event_id for Slack;
• for GitHub, by the SHA-256 of the signed body.

A repeat answers 202 with outcome: "duplicate".

Answers

Every answer except Slack’s URL check is JSON with outcome and diagnostic_id, which is also the X-Request-ID header. An added note also has its note_id; a refusal has code and message.

Each endpoint’s Events list in ThreadPage shows its last 20 outcomes, and its row says when the latest event failed. ThreadPage keeps no copy of an event, only its outcome. Events refused while the endpoint is paused or over a limit are not kept to add later, and many services don’t send them again.

Limits

Each note also counts toward the connection’s write limits.

Set up GitHub

1. Create the endpoint with GitHub pull requests and copy its URL and secret.
2. In the repository’s Settings → Webhooks, paste the URL as Payload URL, choose Content type application/json, paste the secret, and pick Pull requests.

GitHub does not resend failed deliveries by itself; use Redeliver in the webhook’s Recent Deliveries.

Set up Slack

1. Create the endpoint with Slack messages, and give ThreadPage your Slack app’s signing secret.
2. In your Slack app’s Event Subscriptions, paste the URL as the Request URL. ThreadPage answers Slack’s URL check.

From n8n, Make or Zapier

Use an HTTP or webhook step: method POST, body type JSON, the text or markdown field, and an id built from the item, so a retried run adds the note once.

If it fails

Next

• Events and subscriptions: the other direction, events out of ThreadPage.
• Rate limits