ShippingV2Service

RegisterWebhook

RegisterWebhook subscribes a callback URL to one event type. Returns the subscriberId and the raw HMAC secret — the secret is never returned again except via rotate-secret. PRO-gated. Requires an active Pro subscription.

post/api/v2/shipping/webhooks

Request

  • Base URL: https://api.worldmonitor.app
  • URL: https://api.worldmonitor.app/api/v2/shipping/webhooks
  • Auth: one of:
    • API key in header X-WorldMonitor-Key
    • API key in header X-Api-Key
    • HTTP bearer

Headers

Idempotency-Keystring

Optional client-generated idempotency key. Retrying a POST with the same key and an identical request body replays the original response (only the status, body, and Content-Type are reproduced) instead of re-executing; reusing the key with a different body is rejected with 422. For mutations this avoids duplicating the side effect, while for batch-read POSTs it replays a cached snapshot that can be up to 24 hours stale. Keys are scoped per authenticated caller (falling back to the source IP for unauthenticated endpoints) and retained for 24 hours.

Request body

callbackUrlstring required

HTTPS callback URL. Must not resolve to a private/loopback address at registration time (SSRF guard). The delivery worker re-validates the resolved IP before each send to mitigate DNS rebinding.

chokepointIdsstring[]
alertThresholdinteger

Disruption-score threshold for delivery, 0-100. Default 50; an explicit 0 delivers every alert.

eventTypestring

A shared/event-triggers.json key; chokepoint.disruption when omitted.

countriesstring[]
minLiveSignalinteger

chokepoint.disruption live-signal floor; 0 = score only.

Response

OK

subscriberIdstring

wh_ prefix + 24 lowercase hex chars (12 random bytes).

secretstring

Raw 64-char lowercase hex secret (32 random bytes). No whsec_ prefix.

Changes

No recorded changes to this operation across all 1 revision of this API.