---
title: "Handle Xero Webhook"
method: POST
path: "/_webhooks/xero"
---

# Handle Xero Webhook

`POST /_webhooks/xero`

## Request

- Base URL: `https://api.isometric.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.isometric.com/_webhooks/xero`
- Auth: HTTP bearer

Receive webhook events from Xero.

Xero sends an empty `events` list to validate the endpoint ("intent to receive"); a valid
signature (checked in the route dependency) is enough for that handshake, so we simply
acknowledge with 200. Real events are handed to a service that publishes a domain event per
invoice for out-of-band processing.

## Headers

- `x-client-secret` string, nullable: A secret token identifying the client connecting to the API

## Request body

- XeroWebhookPayload
  - `events` XeroWebhookEvent[], required
    - `resourceUrl` string, required
    - `resourceId` string, required
    - `eventDateUtc` string, date-time, required
    - `eventType` string, required
    - `eventCategory` string, required
    - `tenantId` string, required
    - `tenantType` string, required
  - `firstEventSequence` integer, required
  - `lastEventSequence` integer, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

## Changes

- **2026-08-27** `d7235b3750b2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/isometric/apis/isometric-api/changes/_webhooks/xero/post.md)

---

[API](https://skmtc.dev/isometric/apis/isometric-api.md) - [All operations](https://skmtc.dev/isometric/apis/isometric-api/llms.txt) - [OpenAPI document](https://skmtc.dev/isometric/apis/isometric-api/revisions/a2a2a7bdbbcf?raw)