Webhook endpoints | OrderCard Documentation

Webhook endpoints are usually managed in the dashboard, which also shows every delivery and can resend one. These endpoints cover automated set-ups.

Each endpoint belongs to the key’s environment and has its own signing secret. Read Webhooks for the events and the payload, and Verifying signatures before you trust a delivery.

List webhook endpoints

GET/v1/webhook_endpoints

Lists the endpoints of the key's team and environment.

Required ability: webhooks:read
Rate limit: 300 requests/minute per API key

Query parameters

limitintegeroptional: 1 to 100, default 25.
cursorstringoptional: The meta.next_cursor of the previous page.

Requestbash

curl https://api.ordercard.io/v1/webhook_endpoints \
  -H "Authorization: Bearer $ORDERCARD_SECRET_KEY"

200A page of endpoints. Signing secrets are not included.

{ "data": [ {
    "object": "webhook_endpoint",
    "id": "we_01jaxsd2f5h8k1m4p7r0t3w6y9",
    "url": "https://shop.example.com/webhooks/ordercard",
    "description": "Order system",
    "events": ["transaction.succeeded", "transaction.declined"],
    "active": true,
    "environment": "live",
    "created_at": "2026-10-17T15:30:00+00:00",
    "updated_at": "2026-10-17T15:30:00+00:00"
  } ], "links": { "...": "..." }, "meta": { "...": "..." } }

Add a webhook endpoint

POST/v1/webhook_endpoints

Adds an endpoint. The response is the only API answer that includes its signing secret; the dashboard can reveal it later.

Required ability: webhooks:write
Rate limit: 300 requests/minute per API key

Body parameters

urlstringrequired: A public http or https URL. Private, internal and unresolvable addresses are refused.
Example: https://shop.example.com/webhooks/ordercard
descriptionstringoptional: Your label, max 255 characters.
eventsarray<string>required: Event types to receive, or ["*"] for all of them, including types added later: payment_method.created, payment_method.updated, payment_method.redacted, transaction.succeeded, transaction.declined, transaction.failed.
activebooleanoptional: An inactive endpoint receives nothing.

Requestbash

curl -X POST https://api.ordercard.io/v1/webhook_endpoints \
  -H "Authorization: Bearer $ORDERCARD_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://shop.example.com/webhooks/ordercard", "events": ["transaction.succeeded", "transaction.declined"] }'

201The endpoint, with its secret.

{
  "object": "webhook_endpoint",
  "id": "we_01jaxsd2f5h8k1m4p7r0t3w6y9",
  "url": "https://shop.example.com/webhooks/ordercard",
  "description": "Order system",
  "events": ["transaction.succeeded", "transaction.declined"],
  "active": true,
  "secret": "whsec_8sK2…",
  "environment": "live",
  "created_at": "2026-10-17T15:30:00+00:00",
  "updated_at": "2026-10-17T15:30:00+00:00"
}

422The URL is not public.

{
  "error": {
    "code": "invalid_request",
    "message": "Webhooks only go to public http or https addresses. This URL is private, internal or does not resolve.",
    "errors": { "url": ["Webhooks only go to public http or https addresses. This URL is private, internal or does not resolve."] }
  }
}

Retrieve a webhook endpoint

GET/v1/webhook_endpoints/{id}

Returns one endpoint, without its secret.

Required ability: webhooks:read
Rate limit: 300 requests/minute per API key

Path parameters

idstringrequired: The endpoint's id.
Example: we_01jaxsd2f5h8k1m4p7r0t3w6y9

Requestbash

curl https://api.ordercard.io/v1/webhook_endpoints/we_01jaxsd2f5h8k1m4p7r0t3w6y9 \
  -H "Authorization: Bearer $ORDERCARD_SECRET_KEY"

200The endpoint.

{
  "object": "webhook_endpoint",
  "id": "we_01jaxsd2f5h8k1m4p7r0t3w6y9",
  "url": "https://shop.example.com/webhooks/ordercard",
  "description": "Order system",
  "events": ["transaction.succeeded", "transaction.declined"],
  "active": true,
  "environment": "live",
  "created_at": "2026-10-17T15:30:00+00:00",
  "updated_at": "2026-10-17T15:30:00+00:00"
}

Update a webhook endpoint

PATCH/v1/webhook_endpoints/{id}

Changes the URL, description, events or active flag. Only the fields you send change.

Required ability: webhooks:write
Rate limit: 300 requests/minute per API key

Path parameters

idstringrequired: The endpoint's id.
Example: we_01jaxsd2f5h8k1m4p7r0t3w6y9

Body parameters

urlstringoptional: A public http or https URL. Private, internal and unresolvable addresses are refused.
Example: https://shop.example.com/webhooks/ordercard
descriptionstringoptional: Your label, max 255 characters.
eventsarray<string>optional: Event types to receive, or ["*"] for all of them, including types added later: payment_method.created, payment_method.updated, payment_method.redacted, transaction.succeeded, transaction.declined, transaction.failed.
activebooleanoptional: An inactive endpoint receives nothing.

Requestbash

curl -X PATCH https://api.ordercard.io/v1/webhook_endpoints/we_01jaxsd2f5h8k1m4p7r0t3w6y9 \
  -H "Authorization: Bearer $ORDERCARD_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "events": ["*"] }'

200The updated endpoint.

{
  "object": "webhook_endpoint",
  "id": "we_01jaxsd2f5h8k1m4p7r0t3w6y9",
  "url": "https://shop.example.com/webhooks/ordercard",
  "description": "Order system",
  "events": ["transaction.succeeded", "transaction.declined"],
  "active": true,
  "environment": "live",
  "created_at": "2026-10-17T15:30:00+00:00",
  "updated_at": "2026-10-17T15:30:00+00:00"
}

Remove a webhook endpoint

DELETE/v1/webhook_endpoints/{id}

Removes the endpoint and its delivery history.

Required ability: webhooks:write
Rate limit: 300 requests/minute per API key

Path parameters

idstringrequired: The endpoint's id.
Example: we_01jaxsd2f5h8k1m4p7r0t3w6y9

Requestbash

curl -X DELETE https://api.ordercard.io/v1/webhook_endpoints/we_01jaxsd2f5h8k1m4p7r0t3w6y9 \
  -H "Authorization: Bearer $ORDERCARD_SECRET_KEY"

200Confirmation.

{ "object": "webhook_endpoint", "id": "we_01jaxsd2f5h8k1m4p7r0t3w6y9", "deleted": true }