Set a webhook's state, events or address
const url = 'https://api.pixonaut.app/v1/webhooks/example';const options = { method: 'PATCH', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"active":true,"eventTypes":["design.committed","order.status_changed"]}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PATCH \ --url https://api.pixonaut.app/v1/webhooks/example \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "active": true, "eventTypes": [ "design.committed", "order.status_changed" ] }'Operation ID: webhookEndpoints.update
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”object
The event types it receives; empty for every type.
Where it is sent to. A connected store’s is called to check it, even when it is the address it already has: a sandbox store takes any origin, and one that does not answer is enqueued no delivery; a live store must stay on its site’s origin and answer (invalid_webhook_url otherwise). Once it moves or answers, events from then on are delivered: what was waiting is dropped, and the store reads the rest by pulling them with GET /v1/events.
Examples
Connecting a store: The store's webhook endpoint
{ "active": true, "eventTypes": [ "design.committed", "order.status_changed" ]}Example
{ "active": false}Responses
Section titled “Responses”The endpoint
object
The key that owns the endpoint, and alone of the tenant’s keys manages it: the secret key that registered it, or the integration key of the store it was given to. Null for one registered in the studio.
The connected store the endpoint was registered for; null for one registered on its own. Such an endpoint is deleted by disconnecting the store.
Whether the store’s webhook address answered when it was last checked: when the store was approved, or when the address was last sent to PATCH /v1/webhooks/{id}. A sandbox store whose address did not (a local machine, a private address) is connected anyway, but no delivery is enqueued for it, and it reads its events by pulling them with GET /v1/events. Always true for a live store, which is refused an address that does not answer. Always true for an endpoint no store was given, which is not checked.
Examples
Example
{ "active": false, "apiKeyId": "d4c3b2a1-0f9e-4d8c-9b7a-6e5f4d3c2b1a", "connectionId": null, "createdAt": 1760000000000, "cursor": "1042", "eventTypes": [ "design.committed", "order.status_changed" ], "failedCount": 0, "failing": false, "id": "wh_5f2a9c1d7e3b4a6f8c0d2e4a", "reachable": true, "tenantId": "acme", "url": "https://shop.acme.example/wp-json/pixonaut/v1/webhook"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: invalid_event_type, invalid_webhook_url, invalid_input
object
Always sent with invalid_event_type.
Examples
invalid_event_type
{ "error": "invalid_event_type", "type": "string"}invalid_input
{ "error": "invalid_input"}invalid_webhook_url
{ "error": "invalid_webhook_url"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: unauthorized
object
Examples
unauthorized
{ "error": "unauthorized"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: origin_forbidden, forbidden, feature_disabled
object
The feature the tenant does not have. Always sent with feature_disabled.
Examples
feature_disabled
{ "error": "feature_disabled", "feature": "api"}forbidden
{ "error": "forbidden"}origin_forbidden
{ "error": "origin_forbidden"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: not_found
object
Examples
not_found
{ "error": "not_found"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: payload_too_large
object
Always sent with payload_too_large.
Examples
payload_too_large
{ "error": "payload_too_large", "maxBytes": 0}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: rate_limited
object
Examples
rate_limited
{ "error": "rate_limited"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Refused: db_error. A request that failed unexpectedly answers as text instead.
object
Examples
db_error
{ "error": "db_error"}Headers
Section titled “Headers”Every response names the request it answers in X-Request-Id: the id the request was sent with in that header, when it is well formed, else one the API gave it. Quote it when reporting a refusal or a failure: the API’s log lines for that request carry it.
Questions? Write to [email protected].