Create a webhook endpoint
Registers a new endpoint at the given URL and subscribes it to the specified
event types. The signing secret (whsec_…) is returned in this response
and never again — store it immediately. Send an Idempotency-Key header
to make the request safe to retry.
Authorizations
A merchant secret key (sk_…) sent as Authorization: Bearer <key>.
Headers
Required. A unique key that makes retries safe: the same key with the same request body returns the original response instead of repeating the operation.
255Body
The HTTPS URL Ionic will POST event payloads to.
Event types to subscribe to. Each entry is one of:
- an exact type, for example
payment_intent.succeeded; - a resource wildcard, for example
checkout.session.*(all events for that resource); *to subscribe to every event.
Optional label for the endpoint.
API version that pins the event payload shape delivered to this endpoint. Defaults to 2026-05-01.
Response
The created webhook endpoint, including its signing secret.
A webhook endpoint plus its signing secret (whsec_…) — returned only by create and rotate_secret. The secret is shown exactly once; store it immediately. No other response carries it.
webhook_endpoint Current lifecycle state. active means the endpoint is receiving deliveries.
disabled means it is paused by the merchant. deleted means it has been
soft-deleted. error means deliveries were disabled after repeated
failures.
active, disabled, deleted, error true when status is disabled; false otherwise.
Unix epoch seconds.
The signing secret for verifying deliveries. Shown exactly once, in this response.
Unix epoch seconds when the signing secret was last rotated. Null until the first rotation after creation.
Unix epoch seconds when the endpoint was deleted. Null while active.

