WebHook

Get all configured webhooks

get

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks

Returns all webhook subscriptions configured for the tenant.

Authorization

Requires Webhook.Read scope.

Event Patterns

Supports wildcards:

• customer.* - All customer events

• pass.created - Specific event

• * - All events (use with caution)

Use Cases

• Webhook management UI

• Configuration audit

• Integration documentation

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Responses

200

Webhooks returned.

text/plainapplication/jsontext/json

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Read scope.

text/plainapplication/jsontext/json

500

Unexpected server error.

get

/api/{tenantId}/webhooks

HTTPcURLJavaScriptPython

GET /api/{tenantId}/webhooks HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

[
  {
    "description": null,
    "events": [
      "text"
    ],
    "endpoint": "https://example.com",
    "enabled": false
  }
]

Create a new webhook subscription

post

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks

Registers a new webhook endpoint to receive event notifications.

Authorization

Requires Webhook.Write scope.

Automatic Generation

• ID: 5-character random identifier (automatically assigned)

• SignatureSecret: 64-character secret (automatically generated)

Request Signing

When sending webhook events, the platform adds an X-NEOSTORE-SIGNATURE header containing HMAC-SHA256 signature:

HMAC-SHA256(requestBody, signatureSecret)

Endpoint Requirements

• Must accept POST requests

• Should respond within 30 seconds

• Should return 2xx status code for success

• Must use HTTPS in production

Event Wildcards

• pass.* - All pass events

• customer.created - Specific event

• store.*.updated - Pattern matching

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

tenantIdstringRequired

Body

application/jsontext/jsonapplication/*+json

or

Responses

200

OK

text/plainapplication/jsontext/json

201

Webhook created.

400

Invalid webhook payload.

text/plainapplication/jsontext/json

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Write scope.

text/plainapplication/jsontext/json

500

Unexpected server error.

post

/api/{tenantId}/webhooks

HTTPcURLJavaScriptPython

POST /api/{tenantId}/webhooks HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 87

{
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

application/jsontext/jsonapplication/*+json

{
  "id": "text",
  "signatureSecret": "text",
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

Get a specific webhook by ID

get

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks/{id}

Retrieves detailed information about a single webhook subscription.

Authorization

Requires Webhook.Read scope.

Security Note

The signature secret is sensitive. Store it securely and never expose it in client-side code.

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

idstringRequired

Identifier of the webhook

tenantIdstringRequired

Responses

200

Webhook returned.

text/plainapplication/jsontext/json

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Read scope.

text/plainapplication/jsontext/json

404

Webhook not found.

text/plainapplication/jsontext/json

500

Unexpected server error.

get

/api/{tenantId}/webhooks/{id}

HTTPcURLJavaScriptPython

GET /api/{tenantId}/webhooks/{id} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

{
  "id": "text",
  "signatureSecret": "text",
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

Update an existing webhook

put

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks/{id}

Modifies webhook configuration while preserving ID and signature secret.

Authorization

Requires Webhook.Write scope.

Updatable Fields

• Description

• Events (array of event patterns)

• Endpoint URL

• Enabled status

Preserved Fields

• ID (immutable)

• SignatureSecret (immutable - use same secret for request validation)

Use Cases

• Change event subscriptions

• Update endpoint URL

• Enable/disable webhook temporarily

• Modify description

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

idstringRequired

Identifier of the webhook

tenantIdstringRequired

Body

application/jsontext/jsonapplication/*+json

or

Responses

200

Webhook updated.

No content

400

Invalid webhook payload.

text/plainapplication/jsontext/json

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Write scope.

text/plainapplication/jsontext/json

404

Webhook not found.

text/plainapplication/jsontext/json

500

Unexpected server error.

put

/api/{tenantId}/webhooks/{id}

HTTPcURLJavaScriptPython

PUT /api/{tenantId}/webhooks/{id} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 87

{
  "description": null,
  "events": [
    "text"
  ],
  "endpoint": "https://example.com",
  "enabled": false
}

application/jsontext/jsonapplication/*+json

No content

Delete a webhook subscription

delete

https://app.neostore.cloudhttps://app-qa.neostore.cloud

/api/{tenantId}/webhooks/{id}

Permanently removes a webhook. The endpoint will no longer receive event notifications.

Authorization

Requires Webhook.Write scope.

Behavior

• Webhook is immediately removed from configuration

• No further events will be sent to the endpoint

• Action cannot be undone (must recreate webhook if needed)

Required scopes

This endpoint requires the following scopes:

Authorizations

admin-bearerapiKey

OAuth2implicitRequired

Authorization URL:

Path parameters

idstringRequired

Identifier of the webhook

tenantIdstringRequired

Responses

200

Webhook deleted.

No content

401

Caller not authenticated.

text/plainapplication/jsontext/json

403

Caller lacks Webhook.Write scope.

text/plainapplication/jsontext/json

404

Webhook not found.

text/plainapplication/jsontext/json

500

Unexpected server error.

delete

/api/{tenantId}/webhooks/{id}

HTTPcURLJavaScriptPython

DELETE /api/{tenantId}/webhooks/{id} HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_OAUTH2_TOKEN
Accept: */*

No content