Easy Labs
APIAccount & operationsWebhooks

Register a webhook endpoint

Register a new webhook endpoint to receive real-time event notifications. The secret is returned only once — store it securely.

POST
/v1/api/webhooks/

Authorization

apiKey
x-easy-api-key<token>

Merchant API key. Publishable keys (pk_test_* / pk_live_) are safe for browser/frontend use and carry a limited scope set (sessions, payment_instruments, customers, orders writes; products, product_prices, payment_links reads). Secret keys (sk_test_ / sk_live_*) grant full admin access and must only be used server-side.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://loading/v1/api/webhooks/" \  -H "Content-Type: application/json" \  -d '{    "url": "http://example.com"  }'
{
  "success": true,
  "timestamp": "2019-08-24T14:15:22Z",
  "data": null,
  "message": "string",
  "pagination": {
    "total": 0,
    "limit": 1,
    "offset": 0,
    "has_more": true,
    "truncated": true,
    "cursors": {
      "first": "string",
      "last": "string"
    }
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}

Update a security rule

Previous Page

Rotate a webhook endpoint's signing secret

Issue a new signing secret for this endpoint and retire the current one. During the overlap window BOTH secrets verify — deliveries carry one sha256= entry per valid secret, so you can deploy the new one without dropping events. Set overlap_hours to 0 to revoke the old secret immediately, which is what you want if it leaked. The new secret is returned only once.