API reference

Webhook endpoints

A webhook endpoint is an HTTPS URL on your server that receives events. The signing secret (whsec_…) is returned once, on creation and on each roll. Limits: 1 endpoint (Unverified) or 10 (Verified) per mode. The URL must be https, port 443 or 8443, a public host name (no IP literals, no private or loopback ranges, checked again at every delivery), up to 2,048 characters, with no credentials in it.

The `webhook_endpoint` object

JSON

{
  "id": "we_tx7j2vmn3r2px2vpwbtz5h7b",
  "object": "webhook_endpoint",
  "livemode": true,
  "created": "2026-09-03T10:00:00.000Z",
  "url": "https://acme.example/webhooks/orrerie",
  "description": "Shop backend",
  "enabled_events": [
    "order.paid",
    "order.underpaid",
    "order.overpaid",
    "order.expired",
    "refund.confirmed"
  ],
  "status": "enabled",
  "disabled_reason": null,
  "api_version": "2026-10-11",
  "secret_last4": "k3Qw",
  "previous_secret_expires_at": null,
  "last_success_at": "2026-10-11T14:09:56.020Z",
  "last_failure_at": null,
  "metadata": {}
}

Table: The webhook_endpoint object
Field	Meaning
`enabled_events`	Event types to send. ["*"] sends all.
`status`	One of `enabled`, `disabled`.

The `webhook_delivery` object

JSON

{
  "id": "whd_dybzssesbh653tqfzcx0txw8",
  "object": "webhook_delivery",
  "livemode": true,
  "created": "2026-10-11T14:09:55.990Z",
  "event": "evt_srcv6en5gsj0b001t5650atx",
  "endpoint": "we_tx7j2vmn3r2px2vpwbtz5h7b",
  "attempt": 1,
  "status": "succeeded",
  "response_status": 200,
  "duration_ms": 142,
  "error": null,
  "next_attempt_at": null,
  "manual": false
}

Table: The webhook_delivery object
Field	Meaning
`status`	One of `pending`, `succeeded`, `failed`.

Every field

Fields of the `webhook_endpoint` object

Fields of the webhook_endpoint object
Field	Type	Meaning
`id`	string	Unique identifier: the object prefix, an underscore, 24 lower-case Crockford base32 characters.
`object`	string	The type of this object.
`livemode`	boolean	`true` for live mode (real money); `false` for test mode (simulated payments).
`created`	string (date-time)	When the object was created. RFC 3339, UTC, milliseconds.
`url`	string	The HTTPS address events are sent to.
`description`	string or null	The merchant's note about the endpoint; `null` for none.
`enabled_events`	array of strings	Event types to send. ["*"] sends all.
`status`	string	One of `enabled`, `disabled`.
`disabled_reason`	string or null	Why a disabled endpoint is disabled: by_member, or consecutive_failures after 7 days of failed deliveries. `null` while enabled. One of `by_member`, `consecutive_failures`, `null`.
`failing`	boolean	`true` after 24 hours of consecutive failed deliveries. Not a state: the endpoint stays enabled until 7 days of failures disable it (disabled_reason consecutive_failures).
`failing_since`	string (date-time) or null	When the run of failed deliveries began; `null` while deliveries succeed.
`api_version`	string	The API version events to this endpoint are written in.
`secret_last4`	string	The last four characters of the signing secret, to tell secrets apart.
`previous_secret_expires_at`	string or null	When the secret replaced by the last roll stops signing; `null` when none is still signing.
`last_success_at`	string (date-time) or null	When a delivery last succeeded; `null` for never.
`last_failure_at`	string or null	When a delivery last failed; `null` for never.
`metadata`	object	Up to 50 keys of your own data. Key up to 40 characters, value a string up to 500 characters. Never used by Orrerie; never put secrets or personal data here.

Fields of the `webhook_delivery` object

Fields of the webhook_delivery object
Field	Type	Meaning
`id`	string	Unique identifier: the object prefix, an underscore, 24 lower-case Crockford base32 characters.
`object`	string	The type of this object.
`livemode`	boolean	`true` for live mode (real money); `false` for test mode (simulated payments).
`created`	string (date-time)	When the object was created. RFC 3339, UTC, milliseconds.
`event`	string	The `evt_` id of the event delivered.
`endpoint`	string	The `we_` id of the endpoint it was sent to.
`attempt`	integer	Which try this was, counting from 1.
`status`	string	One of `pending`, `succeeded`, `failed`.
`response_status`	integer or null	The HTTP status the endpoint answered; `null` when it answered none.
`duration_ms`	integer or null	How long the try took, in milliseconds; `null` while it has not ended.
`error`	string or null	Why the try failed, for example `timeout`, `http_error` or `redirect_refused`; `null` when it succeeded.
`next_attempt_at`	string or null	When the next try is due; `null` when none is.
`manual`	boolean	`true` for a try a person asked for (a resend or a test event).

Endpoints

Events

Webhook events whose data.object is an object of this page.

Webhook endpoints

The webhook_endpoint object

The webhook_delivery object