Skip to main content
POST
cURL
Ledger sends the events in enabledEvents to url, signed with the endpoint’s secret. Use ["*"] for every event, including ones added later. The event reference lists each type. The response carries the signing secret (whsec_…) once. Store it, then verify each request with it. To replace it, rotate the secret in Settings › Webhooks.
  • URL: Live endpoints must be public https:// URLs. Private, loopback and internal hosts are refused.
  • Limit: 16 endpoints per environment; another returns 409 endpoint_limit_reached.
  • Errors: an unknown event type is 400 invalid_request; a URL Ledger can’t send to is 400 https_required, private_address, credentials_in_url or invalid_url.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
url
string
required

Where Ledger sends events. Live and production endpoints must be public https:// URLs.

Required string length: 1 - 2048
Example:

"https://example.com/webhooks/ledger"

enabledEvents
enum<string>[]
required
Required array length: 1 - 50 elements

An event type, or * for every event.

Available options:
*,
customer.created,
customer.deleted,
subscription.created,
subscription.updated,
subscription.canceled,
invoice.paid,
credits.granted,
balance.low,
balance.depleted,
checkout.completed,
checkout.expired
description
string | null
Maximum string length: 200

Response

Endpoint created, with its signing secret

object
enum<string>
required
Available options:
webhook_endpoint
id
string
required
url
string
required
description
string | null
required
enabledEvents
string[]
required
apiVersion
string
required
status
enum<string>
required
Available options:
enabled,
disabled
disabledReason
enum<string> | null
required
Available options:
failing,
manual,
null
disabledAt
string | null
required
failingSince
string | null
required
livemode
boolean
required
environment
enum<string>
required
Available options:
sandbox,
live
createdAt
string
required
updatedAt
string
required
secret
string
required

The signing secret (whsec_…). Returned only here; store it to verify the Ledger-Signature header.