Contract-first REST for builders and agents. Same control plane as Fat Heron products — documented here for the developer surface.
Receive account events at a public HTTPS URL (SSRF-guarded).
Required scopes: notifications:write · Base https://api.fatheron.dev
1. Create webhook
POST /v1/notifications/webhooks
X-API-Key: fh_live_…
Content-Type: application/json
{
"label": "agent-sink",
"url": "https://example.com/hooks/fatheron",
"enabled": true,
"events": [
"alias.created",
"onboarding.completed",
"invoice.paid"
]
}Optional signing_secret. URL must be public http(s); private/metadata hosts are denied.
2. List deliveries / retry
GET /v1/notifications/deliveries X-API-Key: fh_live_…
Retry with POST /v1/notifications/deliveries/{id}/retry.
url_not_allowed
Use a public HTTPS endpoint (no localhost / link-local).
unsupported_events:…
Use event ids from notification preferences catalog.