API Reference

Webhook Management

Configure where Qwik POSTs events. These endpoints use organization credentials only (no user session). For the receiving side — envelope, signature verification, retries — see Webhooks.

POST/partner/webhooks

🔑 Org key + secret
FieldTypeRequiredNotes
urlstring✅HTTPS URL.
eventsstring[]—Subset to subscribe to. Empty/omitted = ALL events. Values must be from the event catalog.
descriptionstring—Max 500 chars.
201 · Response
{
  "webhook": {
    "id": "uuid", "partner_id": "uuid", "url": "https://your-app.example.com/qwik/webhook",
    "events": ["Payment.ACH.Completed"], "is_active": true,
    "description": "Production webhook", "created_at": "...", "updated_at": "...",
    "secret_set": true
  },
  "secret": "8a2f...base64url-32-bytes...",
  "message": "Store this secret securely — it will not be shown again. Use it to verify the X-Qwik-Signature header on incoming webhook requests."
}
!
The secret is shown once. Store it server-side; you need it to verify deliveries. Reads never return it (they expose only secret_set: true).

GET/partner/webhooks

🔑 Org key + secret
200 · Response
{
  "webhooks": [ /* webhook objects, secret omitted */ ]
}

GET/partner/webhooks/:webhookId

🔑 Org key + secret
200 · Response
{
  "webhook": { ... }
}

404 if not found / not yours. webhookId is a UUID.

PATCH/partner/webhooks/:webhookId

🔑 Org key + secret

Body — all optional: url, events, is_active (boolean), description.

200 · Response
{
  "webhook": { ... }
}

DELETE/partner/webhooks/:webhookId

🔑 Org key + secret
200 · Response
{
  "deleted": true
}

404 if not found.

POST/partner/webhooks/:webhookId/rotate-secret

🔑 Org key + secret

Mints a new signing secret (returned once); the previous one stops verifying immediately.

200 · Response
{ "webhook_id": "uuid", "secret": "<new-secret>", "message": "Update your signature-verification config immediately. The previous secret is now invalid; the new one will not be shown again." }

GET/partner/webhooks/:webhookId/deliveries

🔑 Org key + secret

Delivery log for debugging. Query: status (pending|delivered|failed|permanently_failed), limit (default 50, max 100), offset (default 0).

200 · Response
{
  "deliveries": [
    {
      "id": "uuid", "event_type": "Payment.ACH.Completed", "event_id": "...",
      "status": "failed", "attempt_count": 4, "last_attempt_at": "...",
      "response_status": 500, "error_message": "non-2xx response: 500", "created_at": "..."
    }
  ],
  "pagination": { "limit": 50, "offset": 0, "total": 3 }
}