Skip to main content
A webhook endpoint (whe_…) is an HTTPS URL plus the set of event types Ionic delivers to it. You register an endpoint once, and Ionic sends each matching event to it as a POST. Endpoints are scoped to one mode: a test key manages test-mode endpoints and a live key manages live ones. To manage endpoints, see Manage endpoints. To learn how deliveries work, see the webhooks overview. The signing secret (whsec_…) is returned only when you create an endpoint or rotate its secret. Store it then. Use it to verify each delivery. An endpoint’s scope is its delivery stream, and it cannot change. account delivers events for your own account. connected_accounts delivers events from merchants connected to your platform. Ionic derives the scope from the credential, so a platform credential creates a connected_accounts endpoint. For platforms, create these endpoints without Ionic-Account. See Webhooks for platforms.

​
Attributes

​
string
Unique identifier for the webhook endpoint (whe_…).
​
string
The HTTPS URL Ionic sends event payloads to.
​
string
The immutable event stream delivered to this endpoint.
​
array of strings
Event types this endpoint receives, as exact types or wildcards.
​
string
API version that pins the event payload shape delivered to this endpoint.
​
string
Current lifecycle state. active means the endpoint is receiving deliveries. disabled means it is paused by the merchant. deleted means it has been soft-deleted. error means deliveries were disabled after repeated failures.
​
boolean
true when status is disabled; false otherwise.
See every field in the response of Retrieve a webhook endpoint.

​
Endpoints

​
Statuses

disabled is true when status is disabled, and false otherwise. To pause an endpoint, set disabled to true or status to disabled. To resume it, set disabled to false or status to active. Send only one of the two fields in a request.

​
Rules

  • event_types accepts an exact type such as payment_intent.succeeded, a resource wildcard such as checkout.session.*, or * for every event. You can mix them in one array.
  • Every write (create, update, delete, rotate) requires an Idempotency-Key header. Retrying with the same key and body returns the original response. See Idempotency.
  • api_version pins the event payload shape for the endpoint. It defaults to 2026-05-01.
  • List and retrieve responses never include the signing secret.
  • After a rotation, the previous secret keeps verifying for a brief overlap window.
  • For connected accounts’ events, delivery also requires an active Connection that grants the matching read permission. Registering an endpoint grants no resource access.