Callback URLs must use https
A webhook on any /v1 run requires an https URL. A plain http URL is rejected at create with 400 invalid_request. This rule has applied since 2026-09-01. Saved endpoints already had it.
Run deliveries also stop following redirects. This covers capability runs, pipelines, and /process callbacks. A 3xx answer from your endpoint counts as a failed attempt, and its status appears in GET /v1/webhooks/{id}/deliveries. Agent run deliveries still follow up to five redirects, with the same POST at each hop.
Both changes close the same trap. If an http endpoint answers with a 301 or 302 redirect to https, the redirected POST becomes a GET. The endpoint then receives no payload and answers 405, which looks like we changed the method. Register the final https URL and every delivery stays a POST.