v2.webhook_endpoints

Create a webhook endpoint (platform key)

Platform keys only. Registers an https endpoint and returns its signing secret exactly once. livemode follows the key: endpoints created with a sandbox key receive cooud.ping and the simulated cooud.order.paid of the sandbox checkout sessions the platform creates on behalf of an account and confirms with the success test card (livemode: false, data.id ord_sim_<ULID>, data.checkout_session_id), never a real order; real events reach endpoints created with a live key (live is enabled by default for every platform, unless Cooud suspended it).

post/webhook_endpoints

Request

  • Base URL: https://api.cooud.com/v2
  • URL: https://api.cooud.com/v2/webhook_endpoints
  • Auth: HTTP bearer

Headers

Cooud-Compat-Datestring date required

Required per-request compat-date. Format: ISO calendar date YYYY-MM-DD. Merchants pinned to an older date have their request and response transformed by every gate whose appliesAfter is strictly greater than this date.

Request body

descriptionstring nullable

Free text shown back on the endpoint, at most 200 characters.

enabled_eventsstring[]

Events to deliver. Defaults to every subscribable event (cooud.order.paid, cooud.order.refunded, cooud.account.updated). cooud.ping is always delivered. cooud.payment.processing and cooud.payment.expired are opt-in: they are delivered only when listed here, never by default.

urlstring required

Absolute https URL on a public host. localhost, IP literals and internal names are refused with parameter_invalid.

Response

The endpoint and its signing secret (shown once).

createdinteger required

Unix epoch seconds.

descriptionstring nullable required
enabled_eventsstring[] required
idstring required
livemodeboolean required

true when the endpoint was created with a live platform key. Real events (cooud.order.*, cooud.account.updated) are only delivered to live endpoints; sandbox endpoints receive cooud.ping and the simulated cooud.order.paid (livemode: false, data.id ord_sim_…, data.checkout_session_id) of the sandbox checkout sessions the platform confirms — never a real order.

object'webhook_endpoint' required
request_idstring required
status'active' | 'disabled' required
urlstring required
secretstring required

Signing secret (whsec_*) used to verify X-Cooud-Signature (HMAC-SHA256 over {t}.{raw_body}). Returned only in this response; store it immediately.

Changes

No recorded changes to this operation across all 1 revision of this API.