Overview
Manage outbound developer webhook destinations, event filters, safe tests, and signing-secret rotation.
A webhook channel connects selected store events to a URL in your application. Each channel has a stable UUID, a public callback URL, and an allowed_notifications list of events to send. For verification and delivery rules, start with the webhook guide.
Authenticate with a Sanctum token carrying the webhook ability. The actor must also have webhook-management permission for the store selected by X-STORE.
allowed_notifications contains the same public event names delivered in webhook payloads, such as order.created. SellApp maps these names to its internal notification subscriptions without exposing those implementation keys.
The test endpoint accepts a public delivery event name and rejects the test unless that event is enabled on the channel. For example, test order.created on a channel containing order.created.
Appointment changes use the public events booking.cancelled and booking.rescheduled. Their payloads omit provider error strings and credentials.
The search endpoint uses the same public event names. For example, filter with event=order.created.
Channel UUIDs do not change when another channel is deleted or updated. Callback URLs must resolve to public network addresses; SellApp rechecks and pins a public address when delivering and does not follow redirects. Discord webhook URLs belong in notification settings and are rejected here.
The signing secret is store-wide. Rotate it by sending a new value to the write-only signing-secret endpoint. API responses expose only signing_secret_configured; they never return the stored secret or sensitive delivery headers.
Normal deliveries run in the background with the documented retry behavior. Test sends wait for one attempt and return its delivery status. The event must already be enabled on the channel. Tests use the same top-level event and version fields as production: most events carry version: "1", while order.partial_paid remains versionless for compatibility in both real and test deliveries.