API reference
Readable endpoints, authentication, permissions, and request examples for the server-side management API.
Base URL and authentication
The public management API is served under https://pantherhook.com/api/v1. Send a workspace-scoped token using Authorization: Bearer. Tokens are secret credentials and must never be embedded in browser code.
Each endpoint checks the matching read, write, create, delete or replay scope. Resources must belong to the token’s workspace.
curl -H 'Authorization: Bearer YOUR_API_TOKEN' \
https://pantherhook.com/api/v1/formsClients and projects
- GET /clients, GET /clients/:id, POST /clients, PATCH /clients/:id
- GET /clients/:clientId/projects, GET /projects/:id
- POST /clients/:clientId/projects, PATCH /projects/:id
- Scopes: clients:read/write and projects:read/write respectively.
Forms and submissions
Server-side submissions accept JSON payloads, including an optional test: true. The management API submission route does not support file attachment tokens.
- GET /forms, GET /forms/:id, POST /forms, PATCH /forms/:id
- GET /forms/:formId/submissions, POST /forms/:formId/submissions
- GET /submissions/:id, PATCH /submissions/:id/outcome, DELETE /submissions/:id
- Scopes: forms:read/write and submissions:read/create/write/delete as appropriate.
Webhooks, replays, and files
- GET /forms/:formId/webhooks, GET /webhooks/:id
- POST /forms/:formId/webhooks, PATCH /webhooks/:id, DELETE /webhooks/:id
- POST /webhook-deliveries/:id/replay (scope: deliveries:replay)
- GET /files/:id/download (scope: files:read)
- The webhook signing secret is only returned at creation; treat it as sensitive.
Machine-readable schema (for tooling)
The raw OpenAPI JSON is intended for generators, HTTP clients, and API tooling. It is not a documentation web page. Use the Download link only if you need the machine-readable file.
Download OpenAPI JSON (machine-readable)