Webhooks

Create a webhook endpoint

Create a webhook endpoint that receives event notifications via HTTPS callbacks. The signing secret is returned once in this response and never again — store it securely.

post/companies/{company}/webhook-endpoints

Request

  • Base URL: https://api.factuarea.com/v1
  • URL: https://api.factuarea.com/v1/companies/{company}/webhook-endpoints
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Path parameters

companystring uuid required

Public identifier (UUID v7) of the company. Get it from GET /v1/me (data.scope[].id).

Headers

Idempotency-Keystring
Example:01928f10-7c0e-7c4a-9b7d-2f8a6e3c1d4b

Client-generated opaque key (up to 255 characters; UUID v7 recommended) that makes retries safe: the first response is cached and replayed for repeats without re-executing the mutation. Reusing a key with a different body returns 422 idempotency_key_reused; the values of secret fields (password, secret…) count as part of the body, so retrying with a corrected secret under the same key is a different request, never the replay of the earlier answer. See the Idempotency guide.

Factuarea-Versionstring date
Example:2026-06-01

Pin the API version (YYYY-MM-DD, Stripe-style date versioning) for this request; omit to use the key's pinned version, or the latest if none. Unsupported version → 400 unsupported_api_version; malformed → 400 parameter_invalid_format. The effective version is echoed in the Factuarea-Version response header. See the Versioning guide.

Request body

urlstring required
enabled_eventsstring[] required
descriptionstring nullable
ip_allowliststring[] nullable
api_versionstring nullable

Payload version (date-based, YYYY-MM-DD) to pin for the events delivered to this endpoint. Supported values: 2026-05-22, 2026-10-01 and 2026-10-05. Omitted or null, the endpoint is pinned at creation to the payload version that matches the effective REST version of the request: 2026-10-05 (the latest) when that version is 2026-10-01 or later (Factuarea-Version header, or the version pinned on the API key), and 2026-05-22 otherwise, including requests without a version header. So nobody receives the new vocabulary without opting in. With 2026-10-01 amounts are JSON numbers and the payment keys are paid_at/paid_on; with 2026-10-05 amounts are decimal strings and the payment keys are paid_recorded_at/paid_date. With 2026-05-22, invoices keep the previous vocabulary (status: sent for an issued invoice, sent_at equal to the issuance instant). A value that is not a YYYY-MM-DD date returns 422 (subcode api_version_invalid_format), and an unsupported one 422 (subcode api_version_unsupported).

metadataMetadata nullable

A free map of up to 50 key→value pairs for storing arbitrary structured data (values are strings up to 500 characters). Unlike custom_fields — an ordered list of typed {field, value} pairs with display semantics, present on the six document resources — metadata is an unordered map for opaque integration data; a document may carry both. The master resources (Client, Supplier) have no custom_fields, so their metadata doubles as the custom-fields store.

Reserved keys (read-only). When the system auto-issues an invoice from a payment correlation (Stripe/GoCardless/MONEI), it writes stripe_subscription_id, stripe_invoice_id, billing_reason, period_start and period_end into that invoice metadata automatically. Do not set or overwrite them by hand — the platform owns them and a manual value may be replaced when the correlation runs.

custom_headersCustomHeaders

Custom HTTP headers (string → string) added to every delivery request for a webhook endpoint. Max 20 entries, each value ≤ 1024 chars. Header names are normalized to Title-Case. Reserved names (Host, Content-Type, Factuarea-Signature, X-Forwarded-*, …) are rejected. Empty object when none are set. Never put secrets here — values are returned verbatim by the API.

timeout_secondsinteger nullable

Example request

{
  "metadata": {
    "erp_code": "IVA-GEN",
    "ledger_account": "477000"
  },
  "custom_headers": {
    "Authorization": "Bearer integration-token",
    "X-Custom-Auth": "tenant-a"
  }
}

Response

Webhook endpoint created successfully. The Location header contains the canonical URL of the newly created resource.

Example response

{
  "data": {
    "id": "01931b3e-7c4a-7f2e-9a8b-3c5d6e7f8a0b",
    "object": "webhook_endpoint",
    "url": "https://example.com/webhooks/factuarea",
    "description": "Webhook principal de producción.",
    "enabled_events": [
      "invoice.created",
      "invoice.paid",
      "quote.approved"
    ],
    "status": "active",
    "ip_allowlist": [
      "203.0.113.10",
      "198.51.100.0/24"
    ],
    "delivery_success_rate_24h": 99.5,
    "last_delivery_at": "2026-01-25T18:00:00Z",
    "last_failure_at": "2026-01-20T09:14:33Z",
    "previous_secret_valid_until": "2026-01-26T18:00:00Z",
    "created_at": "2025-12-15T12:00:00Z",
    "updated_at": "2026-01-25T18:00:00Z",
    "api_version": "2026-10-01",
    "metadata": {
      "erp_code": "IVA-GEN",
      "ledger_account": "477000"
    },
    "custom_headers": {
      "Authorization": "Bearer integration-token",
      "X-Custom-Auth": "tenant-a"
    },
    "timeout_seconds": 10,
    "degraded_since": "2026-01-24T07:30:00Z",
    "secret": "whsec_01HKQS5N8VR7QXJ9K3T6BWPMZA9876543210ABCDEF"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.