Authorization
default A public key (pk./pk_test.) is accepted on /payments, /customers, /links, /invoices and the catalogue reads (/channels, /providers, /countries, /currencies); anything that moves money out, reads the balance or manages the account answers 406 to it. It is an identifier, never an authorization. Use a secret key (sk./sk_test.) for sensitive operations (transfers, refunds, balance), or a restricted key (rk./rk_test.) scoped to specific permissions. The _test. variant of any key selects the sandbox environment, there is no separate sandbox URL. Never expose your secret key in client-side code.
In: header
Header Parameters
Your key for this request, 1 to 128 characters of letters, digits and `. _ : -`. The same request sent again with the same key returns the first answer instead of doing the work twice. See [Idempotency](/api/idempotency).
Request Body
application/json
Your endpoint URL, up to 2048 characters. It must use https:// with a live key; a sandbox key also accepts http://. The URL must resolve to a public internet address: a private or internal address is refused, and so is a URL already registered in this environment. For a local test, use `wajub listen`.
Event types to subscribe to, at least one; `*` for every type. Names are not checked: copy them from the event catalog.
Optional description, up to 500 characters.
Response Body
application/json
application/json
curl -X POST "https://api.wajub.com/webhooks" \ -H "Idempotency-Key: endpoint-orders-prod" \ -H "Content-Type: application/json" \ -d '{ "url": "https://example.com/webhooks/wajub", "events": [ "payment.succeeded", "transfer.succeeded" ] }'{ "code": 201, "endpoint": { "id": "9d4e7a2c-3b1f-4c8e-a6d5-2f8b7c1e0a94", "url": "https://example.com/webhooks/wajub", "secret": "whsec_…", "events": [ "payment.succeeded" ] }}Created