Create a webhook endpoint
Register a new HTTPS endpoint to receive outbound event notifications.
The signing_secret is returned once at creation — store it
immediately. It cannot be retrieved again; rotate it via a DELETE +
re-create if lost.
Failed deliveries are retried automatically with exponential backoff. If an
endpoint fails 20 deliveries in a row (each after exhausting its retries),
it is automatically disabled (enabled: false) and stamped with a
disabled_reason. Re-enable it with a PATCH once the endpoint is healthy
again; re-enabling resets the failure counter.
Authorizations
API Key Authentication
Use your API key in the Authorization header:
Key Types:
Secret Keys (Server-Side Only):
- Format:
tybrite_sk_live_*(production) ortybrite_sk_test_*(sandbox) - Full read/write access to all endpoints
- ⚠️ NEVER expose in client-side code or public repositories
- Required for: write operations, authentication, payment verification, AI recommendations
Publishable Keys (Client-Safe):
- Format:
tybrite_pk_live_*(production) ortybrite_pk_test_*(sandbox) - Read-only access (GET requests only, plus POST semantic search)
- ✅ Safe for client-side JavaScript, mobile apps, and public code
- Allowed for: browsing products, search, CMS content, pricing queries
Endpoint-Specific Requirements:
- Authentication endpoints (
/v1/auth/*): Secret key required - Payment verification (
POST /v1/payments/verify): Secret key required - AI Recommendations (
POST /v1/recommendations): Secret key required - Semantic Search (
POST /v1/search): Both key types allowed (read-only operation) - All write operations: Secret key required
- All read operations: Both key types allowed
Using a publishable key for restricted operations returns 403 Forbidden.
Body
HTTPS destination URL. HTTP is rejected.
"https://yourapp.com/webhooks/tybrite"
Array of event types to subscribe to. Use ["*"] for all events.
Order lifecycle: order.created, order.paid, order.fulfilled,
order.shipped, order.cancelled, order.refunded, order.updated
Payment lifecycle: payment.succeeded, payment.failed, payment.refunded
Customer lifecycle: customer.created, customer.updated, customer.deleted
Inventory & catalog: product.created, product.updated,
product.stock_low, product.out_of_stock
Cart & checkout: cart.created, cart.updated, cart.abandoned
Gift cards: gift_card.issued, gift_card.redeemed, gift_card.expired
Promotions: promotion.applied (a promotion was applied to a checkout),
promotion.created, promotion.activated (a promotion went live or was
scheduled to), promotion.deactivated (a live promotion ended, was paused, or
expired). A promotion awaiting approval is not yet a promotion: no event fires
while it is a draft, and promotion.created arrives when it is approved.
Pricing: pricing_rule.created, pricing_rule.activated (a dynamic-pricing
rule went live), pricing_rule.updated (a live rule's discount, scope, priority,
or window changed — the prices it produces are now different), and
pricing_rule.deactivated. Like promotions, a rule awaiting approval emits
nothing until it goes live. Subscribe to these if you render prices and need to
re-read when the rules behind them change.
Content & collections: collection.created, collection.updated
(a product collection was added, its homepage placement / banner changed, or
its membership changed — products added, removed, or re-ordered). A membership
change carries members_changed: true, and fires once per collection per change,
not once per product.
post.published, lookbook.published, review.approved (a review passed
moderation and is now visible)
Deletion & restore: product.deleted, product_variant.deleted,
promotion.deleted, collection.deleted, post.deleted, lookbook.deleted,
pricing_rule.deleted, customer.deleted, subcategory.deleted — the record
has left the API. It no longer appears in any list, cannot be fetched by id, and
stops taking effect (a deleted promotion stops discounting; a deleted product
cannot be bought). Each carries the record's id and name, plus deleted_at
and restorable_until.
Deleting is reversible for 90 days, so every one of these has a matching
.restored event (product.restored, promotion.restored, and so on) that
fires when the merchant brings the record back. restorable_until tells you how
long you have: you may tear down your copy immediately and rebuild it on
.restored, or hold it until the window closes.
Deleting a product also deletes its variants, so a product.deleted is followed
by a product_variant.deleted for each one. Restoring the product restores them
together.
Visibility: category.activated, category.deactivated,
subcategory.activated, subcategory.deactivated. A category that is switched
off is filtered out of every catalog read, so it disappears from your storefront
exactly as a deleted one would — these events tell you when that happens.
Categories cannot be deleted (they are a fixed platform set a merchant enables or
disables), so this is the only lifecycle signal they produce. Subscribe if you
render navigation, a category strip, or any layout built from the taxonomy.
Store lifecycle & configuration: store.updated (the store's name,
logo, branding, contact, or base currency changed — carries a
changed_fields list), payment_provider.connected (a payment provider was
connected), shipping_provider.connected (a shipping-rate provider was
connected), channel.connected (a sales channel was connected)
Feature availability: feature.status_changed — a capability crossed
from awaiting data to available (or the reverse), e.g. the store's first
approved reviews arrive and reviews become usable. Carries feature,
status, and previous_status. Use this to light up a storefront surface
the moment its data exists. See the automation-webhooks guide.
Catalog sync & syndication: feed.sync.completed (a scheduled
inbound feed-pull finished — carries created/updated/failed counts),
channel.sync.completed (a sales-channel push to Google/Meta/… finished —
carries pushed/rejected counts)
Wholesale (B2B): for stores with wholesale enabled — b2b.rfq.created,
b2b.quote.sent, b2b.quote.accepted, b2b.quote.rejected,
b2b.po.issued, b2b.po.confirmed, b2b.po.fulfilled,
b2b.invoice.issued, b2b.invoice.paid, b2b.invoice.overdue
The store-lifecycle, content, and feature-availability events are designed for automation tools that keep a storefront in step with the store as it grows — the moment a promotion goes live, a collection becomes homepage-eligible, or a licensed capability gains its first data.
Whether the endpoint is active. Disabled endpoints are skipped on delivery.
Opaque key-value pairs for your own reference (not sent in deliveries).
Response
Endpoint created

