Web Hook

Get all configured webhooks

get

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks

Returns all webhook subscriptions configured for the tenant.

Authorization

Requires Webhook.Read scope.

Event Patterns

Supports wildcards:

• customer.* - All customer events
• pass.created - Specific event
• * - All events (use with caution)

Use Cases

• Webhook management UI
• Configuration audit
• Integration documentation

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Responses

200

Webhooks returned.

text/plainapplication/jsontext/json

descriptionstring · nullableOptional

Description of the webhook

eventsstring[] · min: 1Required

Events to listen. Can ends with * to listen to more than one event

endpointstring · uriRequired

Uri where a POST request will be made when the coresponding event happens.

enabledbooleanOptional

Determine if the webhook is enabled

Default: false

idstring · min: 1Required

Unique identifier of this webhook

signatureSecretstring · min: 1Required

Key used to sign the request. When The Wallet Crew platform sends a request it will add a X-NEOSTORE-SIGNATURE header with a hmacsha256 computed from the body content and this secret

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Read scope.

text/plainapplication/jsontext/json

500

Unexpected server error.

get/api/{tenantId}/webhooks

HTTPcURLJavaScriptPython

GET /api/{tenantId}/webhooks HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

[
  {
    "description": null,
    "events": [
      "text"
    ],
    "endpoint": "https://example.com",
    "enabled": false
  }
]

Create a new webhook subscription

post

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks

Registers a new webhook endpoint to receive event notifications.

Authorization

Requires Webhook.Write scope.

Automatic Generation

• ID: 5-character random identifier (automatically assigned)
• SignatureSecret: 64-character secret (automatically generated)

Request Signing

When sending webhook events, the platform adds an X-NEOSTORE-SIGNATURE header containing HMAC-SHA256 signature:

HMAC-SHA256(requestBody, signatureSecret)

Endpoint Requirements

• Must accept POST requests
• Should respond within 30 seconds
• Should return 2xx status code for success
• Must use HTTPS in production

Event Wildcards

• pass.* - All pass events
• customer.created - Specific event
• store.*.updated - Pattern matching

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Body

application/jsontext/jsonapplication/*+json

or

Responses

200

OK

text/plainapplication/jsontext/json

descriptionstring · nullableOptional

Description of the webhook

eventsstring[] · min: 1Required

Events to listen. Can ends with * to listen to more than one event

endpointstring · uriRequired

Uri where a POST request will be made when the coresponding event happens.

enabledbooleanOptional

Determine if the webhook is enabled

Default: false

idstring · min: 1Required

Unique identifier of this webhook

signatureSecretstring · min: 1Required

Key used to sign the request. When The Wallet Crew platform sends a request it will add a X-NEOSTORE-SIGNATURE header with a hmacsha256 computed from the body content and this secret

201

Webhook created.

400

Invalid webhook payload.

text/plainapplication/jsontext/json

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Write scope.

text/plainapplication/jsontext/json

500

Unexpected server error.

post/api/{tenantId}/webhooks

HTTPcURLJavaScriptPython

POST /api/{tenantId}/webhooks HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 87

{
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

application/jsontext/jsonapplication/*+json

{
  "id": "text",
  "signatureSecret": "text",
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

Get a specific webhook by ID

get

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks/{id}

Retrieves detailed information about a single webhook subscription.

Authorization

Requires Webhook.Read scope.

Security Note

The signature secret is sensitive. Store it securely and never expose it in client-side code.

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

idstringRequired

Identifier of the webhook

tenantIdstringRequired

Responses

200

Webhook returned.

text/plainapplication/jsontext/json

descriptionstring · nullableOptional

Description of the webhook

eventsstring[] · min: 1Required

Events to listen. Can ends with * to listen to more than one event

endpointstring · uriRequired

Uri where a POST request will be made when the coresponding event happens.

enabledbooleanOptional

Determine if the webhook is enabled

Default: false

idstring · min: 1Required

Unique identifier of this webhook

signatureSecretstring · min: 1Required

Key used to sign the request. When The Wallet Crew platform sends a request it will add a X-NEOSTORE-SIGNATURE header with a hmacsha256 computed from the body content and this secret

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Read scope.

text/plainapplication/jsontext/json

404

Webhook not found.

text/plainapplication/jsontext/json

500

Unexpected server error.

get/api/{tenantId}/webhooks/{id}

HTTPcURLJavaScriptPython

GET /api/{tenantId}/webhooks/{id} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "id": "text",
  "signatureSecret": "text",
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

Update an existing webhook

put

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks/{id}

Modifies webhook configuration while preserving ID and signature secret.

Authorization

Requires Webhook.Write scope.

Updatable Fields

• Description
• Events (array of event patterns)
• Endpoint URL
• Enabled status

Preserved Fields

• ID (immutable)
• SignatureSecret (immutable - use same secret for request validation)

Use Cases

• Change event subscriptions
• Update endpoint URL
• Enable/disable webhook temporarily
• Modify description

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

idstringRequired

Identifier of the webhook

tenantIdstringRequired

Body

application/jsontext/jsonapplication/*+json

or

Responses

200

Webhook updated.

No content

400

Invalid webhook payload.

text/plainapplication/jsontext/json

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Write scope.

text/plainapplication/jsontext/json

404

Webhook not found.

text/plainapplication/jsontext/json

500

Unexpected server error.

put/api/{tenantId}/webhooks/{id}

HTTPcURLJavaScriptPython

PUT /api/{tenantId}/webhooks/{id} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 87

{
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

application/jsontext/jsonapplication/*+json

No content

Delete a webhook subscription

delete

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks/{id}

Permanently removes a webhook. The endpoint will no longer receive event notifications.

Authorization

Requires Webhook.Write scope.

Behavior

• Webhook is immediately removed from configuration
• No further events will be sent to the endpoint
• Action cannot be undone (must recreate webhook if needed)

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

idstringRequired

Identifier of the webhook

tenantIdstringRequired

Responses

200

Webhook deleted.

No content

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Write scope.

text/plainapplication/jsontext/json

404

Webhook not found.

text/plainapplication/jsontext/json

500

Unexpected server error.

delete/api/{tenantId}/webhooks/{id}

HTTPcURLJavaScriptPython

DELETE /api/{tenantId}/webhooks/{id} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content