Skip to main content
The signing secret is returned in the create-endpoint response. To read it again, call GET /v1/webhooks/endpoints/{endpoint_id}/secret with an API key that has webhooks:read, or view it in the dashboard, which needs permission to manage webhooks. Treat it like a password. If it leaks, rotate the secret to generate a new one.

A webhook endpoint: a URL Bachs delivers events to, and the events it is subscribed to.

​
endpoint_id
string
required

Use this identifier to fetch, update, delete, or rotate the secret on this endpoint, and to scope event listings to it.

Example:

"whe_a1e823c073ab743ce5969ceef2db4d42"

​
name
string
required

The label you gave the endpoint. It is never sent to the endpoint itself.

Example:

"Production events"

​
url
string<uri>
required

The HTTPS URL we POST each subscribed event to. It must be reachable from the public internet and return a 2xx within 10 seconds. Anything else is recorded as a failed attempt; see Retries for which failures we try again.

Example:

"https://api.example.com/webhooks/bachs"

​
enabled
boolean
required

When true, matching events are delivered here. When false, nothing is sent to this URL, not even retries that were already queued, and events from while it was off are not sent later. We set it to false ourselves when deliveries keep failing; see disabled_reason and When an endpoint keeps failing.

Example:

true

​
event_types
enum<string>[]
required

The event types this endpoint receives, stored lowercase. Anything not listed is never delivered here, so add a type before you rely on it.

Available options:
collection.succeeded,
collection.failed,
collection.underpaid,
checkout.completed,
checkout.expired,
payout.created,
payout.paid,
payout.failed,
refund.created,
refund.paid,
refund.failed,
conversion.completed,
conversion.failed,
customer.created,
customer.updated,
dispute.created,
dispute.updated,
customer.subscription.created,
customer.subscription.updated,
customer.subscription.deleted,
invoice.created,
invoice.paid,
invoice.payment_failed
Example:
​
created_at
string
required

When the endpoint was created, as an ISO 8601 timestamp in UTC.

Example:

"2026-03-09T10:00:00.000Z"

​
updated_at
string
required

When the endpoint was last changed, as an ISO 8601 timestamp in UTC. Rotating the signing secret updates this.

Example:

"2026-03-09T10:00:00.000Z"

​
disabled_at
string<date-time> | null

When we turned this endpoint off because its deliveries kept failing, as an ISO 8601 timestamp in UTC. null while the endpoint is enabled, and when you turned it off yourself. See When an endpoint keeps failing.

Example:

"2026-03-12T14:05:00.000Z"

​
disabled_reason
enum<string> | null

Why we turned this endpoint off. consecutive_failures: every delivery to it failed for at least 72 hours, with no success in between, and we emailed a warning at least 48 hours earlier. null while the endpoint is enabled, and when you turned it off yourself.

Available options:
consecutive_failures,
null
Example:

"consecutive_failures"

​
event_source
enum<string>

Which account's events reach this endpoint. account: only events that happened on your own account. connect: only events that happened on accounts you own. all: both.

Available options:
account,
connect,
all
Example:

"account"