OVOK DOCS
Get startedOvokSignalsSDKsGuidesAPI referenceDeveloper resources
Signals API - Clients

Update a user

  • Sandbox: available
  • Staging: available
  • Production: unknown
POST
/v1/signals/api/user/{id}

Sets the name, webhook target, signing secret, events, event schema, reach or credential secret.

Through ovok

  • Who can call it: Manager apps, and users whose access policy grants the capabilities.
  • Capabilities, all required: signals_webhooks:update, signals_events:read. Project admins have every capability; client applications get no admin bypass.
  • Only subscribers are changed through ovok. Their role, eventSchema, clientId, secret and webhookSecret can't be sent.
  • It can reach any patient of your project without naming one, so it is for callers that reach every patient: project admins, manager or submitter apps, and anyone whose Patient access has no criteria.

Authorization

headerAuthorizationBearer <JWT>

Path Parameters

id*string

The client's Signals id.

Request Body

application/json
  1. body
name?string
Lengthlength <= 200
webhookUrl?string
Formaturi
events?array<string>
Items1 <= items
custom?string

v1's custom: an opaque string every webhook carries back as x-actimi-custom.

Lengthlength <= 1024
reach?string
Value in"attached""all"

Response Body

The user as it now stands.

application/json
  1. response
id*string
tenantId*string
clientId*string
name*string
webhookUrl*string

Where alert webhooks are POSTed.

custom?string

v1's custom: an opaque string sent back on every webhook in the x-actimi-custom header. Absent when unset.

hasWebhookSecret*boolean

Whether v1's webhookSecret is set (event schema 1); a schema-2 subscriber signs with its Standard Webhooks secret instead. Never returned: it is write-only.

events*array<string>

Event patterns this client receives, e.g. alert.*.

eventSchema*number

Which names and bodies its webhooks use. 1: v1's, alert.trigger with refire and resolved flags. 2: one type per state change (alert.triggered, alert.refired, alert.resolved, …) in the Standard Webhooks envelope {type, timestamp, sequence, data}, the alert carrying its version.

Value in12
reach*string

A subscriber's patients: attached, those attached to it, as v1's; all, every patient of the tenant, those enrolled later included.

Value in"attached""all"
signingSecret?string

On a new event-schema-2 subscriber's create answer only: its first Standard Webhooks signing secret, returned this once. Rotate it with POST /api/subscriber/{id}/webhook/rotate-secret.

createdAt*string
Formatdate-time
updatedAt*string
Formatdate-time
_id*string

The same value as id.

role*string

The role in v1's lowercase.

tenant*string

The tenant id, under v1's name.

Example Request
curl -X POST 'https://api.sandbox.ovok.com/v1/signals/api/user/string' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "id": "string",  "tenantId": "string",  "clientId": "string",  "name": "string",  "webhookUrl": "string",  "custom": "string",  "hasWebhookSecret": true,  "events": [    "string"  ],  "eventSchema": 1,  "reach": "attached",  "signingSecret": "string",  "createdAt": "2019-08-24T14:15:22Z",  "updatedAt": "2019-08-24T14:15:22Z",  "_id": "string",  "role": "string",  "tenant": "string"}

Get one user GET

Without its secret, which is not retrievable. ### Through ovok - **Who can call it:** Manager apps, and users whose access policy grants the capabilities. - **Capabilities, all required:** `signals_clients:read`. Project admins have every capability; client applications get no admin bypass.

Delete a user DELETE

Revokes the credential at once and drops its undelivered webhook events. ### Through ovok - **Who can call it:** Manager apps, and users whose access policy grants the capabilities. - **Capabilities, all required:** `signals_webhooks:delete`. Project admins have every capability; client applications get no admin bypass. - Only subscribers are deleted through ovok. - It can reach any patient of your project without naming one, so it is for callers that reach every patient: project admins, manager or submitter apps, and anyone whose Patient access has no criteria.