---
title: "Handle Xero Webhook"
method: POST
path: "/_webhooks/xero"
---

# Handle Xero Webhook

`POST /_webhooks/xero`

Receive webhook events from Xero.

Xero sends an empty `events` list to validate the endpoint ("intent to receive"); a valid
signature (checked in the route dependency) is enough for that handshake, so we simply
acknowledge with 200. Real events are handed to a service that publishes a domain event per
invoice for out-of-band processing.

## Headers

- `x-client-secret` string, nullable — A secret token identifying the client connecting to the API

## Request body

- XeroWebhookPayload
  - `events` XeroWebhookEvent[], required
    - `resourceUrl` string, required
    - `resourceId` string, required
    - `eventDateUtc` string, date-time, required
    - `eventType` string, required
    - `eventCategory` string, required
    - `tenantId` string, required
    - `tenantType` string, required
  - `firstEventSequence` integer, required
  - `lastEventSequence` integer, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

## Changes

- **2026-08-27** `d7235b3750b2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/isometric/apis/fastapi/changes/_webhooks/xero/post.md)

---

[API](https://skmtc.dev/isometric/apis/fastapi.md) · [All operations](https://skmtc.dev/isometric/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/isometric/fastapi/revisions/d7235b3750b2/schema)