Webhook endpoints
Create multiple webhook destinations, subscribe them to event types, and rotate their signing secrets safely.
Key points
- Live endpoint URLs must be publicly reachable over HTTPS. enabled_events limits which events each endpoint receives.
- Store each signing secret securely and verify signatures on the raw body before processing.
- Rotate secrets with an overlap period and disable an endpoint when it should stop receiving deliveries.
Example
text
POST /v1/webhook_endpoints
GET /v1/webhook_endpoints
GET /v1/webhook_endpoints/{endpoint_id}
POST /v1/webhook_endpoints/{endpoint_id}
DELETE /v1/webhook_endpoints/{endpoint_id}
POST /v1/webhook_endpoints/{endpoint_id}/rotate_secret