Skip to main content
cURL
Cost: Free.
Needs the webhooks:write scope, and orders:read as well on an endpoint with order event types. The answer carries the new secret once.

Switch without missing a delivery

For 24 hours, every delivery carries a signature from each secret: two in webhook-signature, separated by a space.
  1. Rotate, and store the new secret.
  2. Deploy your verifier with the new secret. Deliveries verify with either secret meanwhile, so the order of your deploys doesn’t matter.
  3. After 24 hours, deliveries carry only the new signature.
The secret on its way out keeps its remaining time, and the one in between ends at once. A delivery never carries more than two signatures.
Send an Idempotency-Key. A retry with the same key answers the same secret instead of making another. See Idempotency.
How signatures work is on Verifying webhooks.

Authorizations

Authorization
string
header
required

An API key: Authorization: Bearer alura_sk_....

Headers

Idempotency-Key
string

Makes a retry safe: the same key with the same request within 24 hours returns the first result (with Idempotent-Replayed: true) instead of writing again. The same key with a different request is a 409 conflict; while the first request still runs, 409 idempotency_processing.

Required string length: 1 - 255

Path Parameters

id
string
required

The webhook endpoint ID (we_...).

Required string length: 1 - 64
Example:

"we_01JMOCK0000000000000000000"

Response

OK

object
string
required
Allowed value: "webhook_endpoint"
id
string
required

we_...

url
string
required

Where events are sent: an HTTPS URL.

description
string | null
required

Your note for this endpoint; null when none was set.

event_types
string[]
required

Etsy's event types this endpoint receives: * for every type, an exact type such as order.paid, or a prefix such as order.*.

shop_ids
string[] | null
required

Only events of these connected shops; null for every connected shop of the workspace, including shops connected later.

status
enum<string>
required

enabled receives events; disabled receives none until enabled again.

Available options:
enabled,
disabled
disabled_reason
enum<string> | null
required

Why a disabled endpoint is disabled: manual (PATCH) or failing (deliveries kept failing). Null while enabled.

Available options:
manual,
failing
created_at
string
required

When the endpoint was created (ISO 8601, UTC).

secret
string
required

The signing secret (whsec_...). Shown once, in this answer; store it to verify deliveries.