Add a webhook endpoint
Adds an endpoint in the credential’s mode. Returns the signing secret. Events start flowing at once; send a test event to check it.
Error codes: invalid_api_key, parameter_invalid, parameter_missing, scope_missing, csrf_token_invalid, idempotency_key_reused, webhook_url_invalid, rate_limited.
Authorizations
Server API key, scoped. pk_test_ keys hit the sandbox tenant.
Headers
Optional on non-money POSTs; honoured when sent.
1 - 255Optional client correlation id, up to 128 characters. It is not echoed: the response's X-Request-Id is always
our own req_… id. We log your value with the request as client_request_id, so support can find a request by
either id. A longer value is refused with 400 parameter_invalid.
128Body
New endpoint.
Name.
1 - 80Must be https:// and publicly reachable (no private, loopback or link-local addresses) → otherwise 422 webhook_url_invalid.
2048At least one known event type (parameter_invalid otherwise).
1Event type, <resource>.<event> (e.g. payment.completed). The catalogue is asyncapi/webhooks.yaml and GET /event-types; clients must tolerate new types.
^[a-z_]+(\.[a-z_]+)+$Response
Endpoint added.
Endpoint with its signing secret.
Endpoint id.
^whe_[0-9A-HJKMNP-TV-Z]{26}$Always webhook_endpoint.
"webhook_endpoint"Mode of the events it receives.
Name shown in the list ("Production backend").
1 - 80HTTPS URL.
2048^https://Event types sent here.
1Event type, <resource>.<event> (e.g. payment.completed). The catalogue is asyncapi/webhooks.yaml and GET /event-types; clients must tolerate new types.
^[a-z_]+(\.[a-z_]+)+$enabled or disabled (by a person; nothing is sent, nothing queues).
enabled, disabled waiting: no deliveries yet. healthy. failing: the last 3 deliveries failed (the developer is emailed "webhook failing").
waiting, healthy, failing Delivery stats over the last 7 days.
Last four characters of the signing secret.
Who added it.
Created.
"2026-10-27T08:41:00Z"
Last change.
"2026-10-27T08:41:00Z"
Signing secret (whsec_…) for PanoFlow-Signature.
^whsec_[A-Za-z0-9]{24,}$When health became failing.
"2026-10-27T08:41:00Z"
Last attempt.
"2026-10-27T08:41:00Z"