get
https://example.com
POST /v2/webhooks — Create webhook
Recent Requests
Log in to see full request history
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Loading…
Notes
payloadVersiondefaults to"v2"when omitted. Pass"v1"explicitly to create a legacy webhook.- When
authentication: true, a 64-character hex signing secret is generated and returned once in thecredentialsfield of the response. Store it securely — it cannot be retrieved again. - Attempting to register a URL that already belongs to another webhook for the same affiliate returns
409 Conflict. webhookInterestsmust contain only recognized event types from the event dictionary. Unrecognised values return400with anunrecognisedfield listing the invalid types.
Required role
affiliate_super_admin
Request body
| Field | Type | Required | Description |
|---|---|---|---|
name | string | ✅ | Human-readable label |
url | string | ✅ | HTTPS endpoint to deliver events to |
authentication | boolean | Enable HMAC signing. Secret returned once on creation | |
payloadVersion | string | "v1" or "v2". Defaults to "v2" | |
webhookInterests | string[] | Array of event type strings to subscribe to | |
enabled | boolean | Initial enabled state. Defaults to true |
Response 201
201{
"id": "webhook::abc123",
"name": "Order sync",
"url": "https://api.example.com/webhooks/orders",
"authentication": true,
"payloadVersion": "v2",
"webhookInterests": ["order_created", "order_submitted"],
"status": "enabled",
"isEnabled": true,
"credentials": "a3f2...64hexchars"
}The credentials field only appears on creation (and after secret rotation). It is not stored in plaintext after this response.