Targets

Targets define how one accepted item is handled. PromptJang Cloud supports webhook, mailbox, and a2a. The legacy /api/v1/endpoints routes remain available for webhook compatibility.

List targets

GET /api/v1/targets
Authorization: Bearer pj_live_YOUR_API_KEY

The response contains { "targets": [...] }. Each target has id, kind, name, enabled, and timestamps. Webhook and A2A targets may include a delivery URL. Mailboxes do not.

Create a webhook target

POST /api/v1/targets
Authorization: Bearer pj_live_YOUR_API_KEY
Content-Type: application/json

{
  "kind": "webhook",
  "name": "Production receiver",
  "url": "https://api.example.com/webhooks"
}

The Standard Webhooks signing secret is returned once in secret. Copy it immediately. Webhook target responses include signing_scheme: "standard-webhooks-v1" and has_previous_signing_secret.

Create a mailbox

{
  "kind": "mailbox",
  "name": "Operations agent"
}

Create an A2A target

{
  "kind": "a2a",
  "name": "Decision agent",
  "agent_card_url": "https://agent.example/.well-known/agent-card.json",
  "auth": { "type": "bearer", "token": "SECRET" }
}

PromptJang fetches the Agent Card, requires an A2A v1 HTTP+JSON interface, validates its HTTPS URL, and encrypts bearer credentials before storage. Use { "type": "none" } for an unauthenticated agent.

Common ingestion

POST /t/:target_id
Authorization: Bearer pj_live_YOUR_API_KEY
Content-Type: application/json
Idempotency-Key: logical-item-123

Each newly accepted webhook event, mailbox message, or A2A handoff creates one local usage record. Retries, reads, claims, acknowledgements, replays, rejected requests, and idempotent duplicates do not create additional usage. Live billing is disabled during the founder-assisted beta, so accepted items are not currently charged. The response is 202 with an item ID and initial state.

Read, update, delete, and refresh

GET /api/v1/targets/:id
PATCH /api/v1/targets/:id
DELETE /api/v1/targets/:id
POST /api/v1/targets/:id/refresh

PATCH accepts name, description, and enabled. refresh is valid only for A2A targets and refreshes the cached Agent Card interface.

Rotate a webhook signing secret

POST /api/v1/targets/:id/signing-secret/rotate
Authorization: Bearer pj_live_YOUR_API_KEY

The response returns the new secret once. During rotation, PromptJang sends current and previous signatures in the same webhook-signature header.

After the receiver uses the new secret:

DELETE /api/v1/targets/:id/signing-secret/previous
Authorization: Bearer pj_live_YOUR_API_KEY