Send events through the API

What is it for?

ShellOrbit is built for receiving webhooks, but the same pipeline works for webhooks you send. Post an event to the API, and ShellOrbit stores it, signs it, delivers it to the endpoint’s destinations, retries on failure, and keeps it for replay, exactly as it would an event from Stripe.

This suits an application with a handful of known destinations: your own services, a partner, or a customer’s server you configure yourself. It is not a portal where your customers manage their own endpoints.

How do I send an event?

Create an endpoint whose destinations are where the event should go, then post the body with an API key that has read and write scope:

curl https://api.shellorbit.com/v1/endpoints/ep_example/events \
  -H "authorization: Bearer $SHELLORBIT_API_KEY" \
  -H "content-type: application/json" \
  -d '{"type":"invoice.paid","data":{"id":"inv_123","amount":4900}}'

The answer is 202 Accepted with the new event’s id:

{ "id": "evt_2Lq9", "received_at": "2026-10-08T09:30:00Z" }

From there the event is the same as any other: it shows in the event log, follows the endpoint’s retry policy, and can be replayed.

What does the destination receive?

The body you sent, byte for byte, with your content type, signed with the endpoint’s signing key. Your API key and the other headers of your request are never forwarded. A top level type field in a JSON body becomes the event type in the dashboard. Verify deliveries with the ShellOrbit signature.

What are the limits?

• A body can be up to 350,000 bytes. A larger one is refused with 413.
• Each event counts toward your monthly volume, the same as a received one, and the same limits apply.
• Ingest keys, IP allowlists, and provider signature checks are skipped, because your API key already proves the event is yours.
• A paused endpoint stores the event and holds it until you resume, like any other.