Skip to content
EntryWick documentation

For a developer, or someone connecting Zapier, a CRM or their own server to an organization's EntryWick.

Webhooks — Organization → Webhooks · api.entrywick.io/v1/webhooks

Who uses it: a developer, or someone connecting Zapier, a CRM or their own server to an organization's EntryWick.

What they came to do: be told the moment something happens — a registration, a payment, a ticket, a check-in — without asking over and over.

True when they leave: an endpoint of theirs receives signed deliveries for the event types it asked for, and they can see every delivery and send one again.

The full contract (event types, envelope, signature, retries) is docs/WEBHOOKS.md.

Making an endpoint

A member with tenant.integrations (Owner, Admin or Developer) opens Organization → Webhooks → New endpoint, or a key calls POST /v1/webhooks. It needs webhooks, on Growth and above (the API does not also need api_write).

  • URL — https only. Every address the host resolves to must be public; private, loopback and internal addresses are refused, now and before every delivery.
  • Event types — any of the 19, or every type (*), which includes types added later.
  • Only this event / only this part of the organization — optional filters. Someone limited to a group only makes endpoints inside it; left out, the filter is their own group.

The signing secret (whsec_…) is shown once, right after the endpoint is made. The API returns it once, in the creating answer. After that only its last four characters show.

Looking after it

Action What happens
Send a test event One delivery with livemode: false, whatever the endpoint subscribes to; never retried, never counted against it.
Rotate secret A new secret, shown once; the old one keeps signing beside it for 24 hours.
Pause / Enable Paused sends nothing; what happens meanwhile is recorded and goes out when it is enabled. Enabling clears the failure count.
Delete The endpoint and its delivery history.

Health: Healthy; Failing after 50 failed attempts in a row (owners are emailed); Paused after 7 days failing, or by a person; Paused: not on this plan when the organization's plan loses webhooks — getting it back enables those endpoints again, and only those.

Deliveries

An endpoint's page lists its deliveries: type, status (pending, delivered, failed, dead), live or test, attempts, the last answer's code and time, and when the next attempt is due. Details shows the envelope exactly as sent, the last signature and the first 1 KB of the answer. Replay (for 30 days from the original delivery; replaying a copy does not start them again) sends the same envelope — the same id — as a new delivery. The API: GET /v1/webhooks/{id}/deliveries?status=&event=, POST /v1/webhooks/deliveries/{id}/replay.

Pausing, enabling, rotating, testing, replaying and every change are in the audit log.

Checking the signature

Every delivery carries EntryWick-Signature, checked as docs/WEBHOOKS.md §4 says. The test vectors there — also on the developer page — let a developer prove their check before pointing it at a live endpoint: each must verify with its secret, and fail with the body changed by a byte. A replay is signed afresh (a new t) over the same body.