Webhooks API

Manage webhooks through the same /admin/webhooks URLs used by the dashboard. Send Authorization: Bearer TOKEN and Accept: application/json. Writes require a write token.

Account tokens manage the account’s webhooks. A co-organizer’s personal token can list, view, create, edit, reactivate and delete only webhooks belonging to that same team membership. New personal webhooks automatically cover all events currently assigned to the membership. The API does not accept an account, membership or event assignment in webhook parameters.

Endpoints

Method	URL	Response
GET	/admin/webhooks	200, { "webhooks": [...] }
GET	/admin/webhooks/:id	200, one webhook including its signing secret
POST	/admin/webhooks	201, created webhook and Location header
PATCH	/admin/webhooks/:id	200, updated webhook
DELETE	/admin/webhooks/:id	204, empty body
POST	/admin/webhooks/:id/activation	200, reactivated webhook

Missing or foreign webhook IDs return 404. A read token attempting a write returns 401. Validation errors return 422 with { "errors": { "field": ["message"] } }.

Create

{
  "webhook": {
    "name": "CRM updates",
    "url": "https://example.com/usetix",
    "subscribed_actions": ["order.paid", "ticket.redeemed"]
  }
}

The URL must use HTTP or HTTPS and resolve to a public IP at delivery time. The URL is immutable after creation; create a new webhook to change destinations. PATCH accepts name and subscribed_actions. An empty subscription array stops new deliveries.

Personal webhooks support order.paid, order.refunded, order.cancelled, event.published, event.unpublished and ticket.redeemed. Account-wide voucher subscriptions are rejected for personal webhooks.

Response

{
  "id": 42,
  "name": "CRM updates",
  "url": "https://example.com/usetix",
  "active": true,
  "scope": "assigned_events",
  "subscribed_actions": ["order.paid", "ticket.redeemed"],
  "created_at": "2026-09-08T12:00:00Z",
  "updated_at": "2026-09-08T12:00:00Z",
  "signing_secret": "YOUR_SIGNING_SECRET"
}

scope is account or assigned_events. The collection omits signing_secret; individual responses include it for verification setup. Keep this secret private.

Personal webhook access is checked again when queued work runs. Deactivation, a role change away from co-organizer, or removal of an event assignment stops affected deliveries. Adding an event assignment automatically includes future updates for that event. Re-enabling a membership does not replay discarded deliveries.

See Webhook delivery and payloads for signing, event types, and the restricted personal payload format.