REST API & Webhooks

The GrowthBook REST API

GrowthBook exposes a REST API that lets you read and manage features, experiments, metrics, and more — programmatically. This is the foundation for CI/CD automation: your deployment pipeline can toggle flags, check experiment status, or create new features without anyone opening the UI.

The base URL for self-hosted installs is your GrowthBook app URL, e.g. http://localhost:3100/api/v1.

Step 1 — Create an API key

In GrowthBook, go to Settings → API Keys.
Click Add API Key.
Choose Secret Key (full read/write access) or Read-only Key (safe for dashboards).
Give it a description, e.g. ci-pipeline.
Click Create and copy the key — it is shown only once.

Step 2 — List features via curl

curl -s \
  -H "Authorization: Bearer YOUR_API_KEY" \
  http://localhost:3100/api/v1/features | \
  jq '.features[] | {id, defaultValue}'

The response is a JSON object. The .features array contains every feature with its key, environments, and rules.

Step 3 — Toggle a feature on/off via curl

# Enable 'checkout-v2' in the production environment
curl -s -X POST \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"environments": {"production": true}}' \
  http://localhost:3100/api/v1/features/checkout-v2/toggles

Replace YOUR_API_KEY with the secret key you created in Step 1, and checkout-v2 with your feature key.

SDK Webhooks

Webhooks are outgoing HTTP calls that GrowthBook fires every time a feature or experiment changes. The primary use case is SDK cache invalidation: your CDN or application server receives the webhook and immediately re-fetches the GrowthBook feature payload, so users get the latest flag state without waiting for the next poll cycle.

Creating an SDK webhook

Go to Settings → SDK Connections and open the SDK connection you want to hook.
Click Webhooks → Add Webhook.
Enter the Endpoint URL — the HTTPS URL your server or CDN listens on.
(Optional) Set a Signing Secret so your server can verify the payload came from GrowthBook.
Click Save. GrowthBook sends a test ping immediately.

Verifying the webhook signature

GrowthBook signs the webhook body with HMAC-SHA256. On your server:

import crypto from 'node:crypto';

function verifyWebhook(body, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

The X-GrowthBook-Signature header contains the hex digest.

Event webhooks

Beyond SDK cache invalidation, GrowthBook also supports event webhooks — notifications for higher-level events such as experiment started, experiment stopped, or feature saved. Configure these under Settings → Event Webhooks.

// Example GrowthBook event webhook payload (feature.updated)
{
  "event": "feature.updated",
  "data": {
    "id": "checkout-v2",
    "environments": {
      "production": { "enabled": true }
    }
  },
  "timestamp": "2025-09-01T12:00:00Z"
}