Overview
Manage outbound developer webhook destinations, event filters, safe tests, and signing-secret rotation.
Webhook channels send selected SellApp store events to your application. Each channel has a stable UUID, a public callback URL, and a complete allowed_notifications filter.
Authenticate with a Sanctum token carrying the webhook ability. The actor must also have webhook-management permission for the store selected by X-STORE.
allowed_notifications contains the same public event names delivered in webhook payloads, such as order.created. SellApp maps these names to its internal notification subscriptions without exposing those implementation keys.
The test endpoint accepts a public delivery event name and rejects the test unless that event is enabled on the channel. For example, test order.created on a channel containing order.created.
Appointment changes use the public events booking.cancelled and booking.rescheduled. Their payloads omit provider error strings and credentials.
The search endpoint uses the same public event names. For example, filter with event=order.created.
Channel UUIDs do not change when another channel is deleted or updated. Callback URLs must resolve to public network addresses; SellApp rechecks and pins a public address when delivering and does not follow redirects. Discord webhook URLs belong in notification settings and are rejected here.
The signing secret is store-wide. Rotate it by sending a new value to the write-only signing-secret endpoint. API responses expose only signing_secret_configured; they never return the stored secret or sensitive delivery headers.
Production webhook calls continue through SellApp's queued delivery system with its normal retry and delivery-tracking behavior. Test sends are synchronous, make one attempt, reproduce the production top-level event and version contract, require the corresponding filter to be enabled on the channel, and return only a delivery status. Most channel events carry version: "1"; order.partial_paid remains versionless for backward compatibility, and its test payload does too.