Skip to main content
POST

Authorizations

Authorization
string
header
required

Source-bound WorkOS API key or configured machine OIDC token. OIDC webhook management requires karsa:webhooks:manage.

Headers

Idempotency-Key
string
required

Stable source submission identifier, unique for this source and route

Required string length: 1 - 200
Example:

"01J9ZQ2YD15Y2YZ5H0W3J7D3E2"

Body

application/json
externalId
string
required

Stable source identity for this immutable RFI event.

Required string length: 1 - 240
requestExternalId
string
required

Stable source request identity shared by every event in the RFI lifecycle.

Required string length: 1 - 240
customerId
string
required

Karsa customer resourceId returned by customer ingestion.

Required string length: 1 - 240
eventType
enum<string>
required
Available options:
REQUESTED,
RESPONDED,
EXPIRED,
CLOSED,
CANCELLED
sourceStatus
string
required
Required string length: 1 - 240
occurredAt
string<date-time>
required
effectiveAt
string<date-time>
required
fieldKeys
string[]

Requested field names only. Do not send raw customer response values here.

Maximum array length: 100
Required string length: 1 - 240
responseExternalId
string | null
Required string length: 1 - 240
disposition
string | null
Required string length: 1 - 5000
actorExternalId
string | null
Required string length: 1 - 240
dueAt
string<date-time> | null
providerDetails
object | null

Optional bounded source metadata. Credentials and signed URLs are rejected.

Response

The identical source historical RFI event already exists

outcome
enum<string>
required
Available options:
CREATED,
EXISTING
resourceId
string
required
Minimum string length: 1
observedAt
string<date-time>
required