agent-cronjob

Step 3. Poll verification state with the setup_token. The first call after the webhook is verified returns hmac_secret (signs triggers) and management_token (manages the job) — SHOWN ONCE, store them now; later calls say credentials: "already_issued". (REST: GET /v1/jobs/{id}/verification)

Step 1. Register your webhook and schedule (no account, no API key). Returns job_id and a one-time setup_token, and POSTs a url_verification challenge to webhook_url. Your webhook must answer it (echo: reply 2xx {"challenge":"<same>"}) — then call claim_credentials. Or reply 2xx and call verify_challenge with the value (callback). Nothing triggers before verification. (REST: POST /v1/jobs)

Stop the job forever and revoke all its credentials. Cannot be undone. (REST: DELETE /v1/jobs/{id})

Trigger log, newest first: scheduled_at, first attempt time, delay, attempts, status and last response code of each run. since/until (ISO 8601) filter scheduled_at; page with next_cursor. (REST: GET /v1/jobs/{id}/runs)

Settings, status, next_run_at, run_count and credential prefixes of one job (webhook path masked). (REST: GET /v1/jobs/{id})

One run and each delivery attempt: sent_at, response status, duration, error and next retry. (REST: GET /v1/jobs/{id}/runs/{run_id})

On-time rate, p50/p95 first-attempt delay and success rate over a window (default 24h). (REST: GET /v1/jobs/{id}/stats)

Status of every job you hold a management token for. There are no accounts, so pass each {job_id, management_token} pair (up to 20); a pair without management_token uses the Authorization header. (REST: GET /v1/jobs/{id} (once per job))

Stop triggering (idempotent). Schedule points while paused are not made up later. (REST: POST /v1/jobs/{id}/pause)

Resume a paused or disabled job from its next schedule point; resets consecutive_failures. (REST: POST /v1/jobs/{id}/resume)

Re-send a fresh url_verification challenge to your webhook (at most 5 re-sends (6 challenges in total), at least 60 s apart). The previous challenge stops working. (REST: POST /v1/jobs/{id}/verification/retry)

New hmac_secret (SHOWN ONCE, store it now). Until previous.expires_at (grace_sec, default 24 h) triggers carry two v1= signatures, new first. (REST: POST /v1/jobs/{id}/rotate-secret)

New management_token (SHOWN ONCE, store it now). The old one stops working after grace_sec (default 0 = immediately). (REST: POST /v1/jobs/{id}/rotate-token)

Change a job in place: signature_in_body (true = triggers also carry cronjob_signature in the JSON body, for platforms that drop the X-Cronjob-* headers; applies from the next attempt sent) and/or max_runs. Raising max_runs on a job completed with max_runs_reached reactivates it (next run = next occurrence after now, no catch-up); there is no separate resume for completed jobs. Returns the updated job. (REST: PATCH /v1/jobs/{id})

Step 2 (callback mode). Send back the challenge value your webhook received. On success the result holds hmac_secret and management_token — SHOWN ONCE, store them now. (REST: POST /v1/jobs/{id}/verify)