Webhooks

Create a webhook endpoint

Register a new HTTPS endpoint to receive outbound event notifications. The signing_secret is returned once at creation — store it immediately. It cannot be retrieved again; rotate it via a DELETE + re-create if lost.

Failed deliveries are retried automatically with exponential backoff. If an endpoint fails 20 deliveries in a row (each after exhausting its retries), it is automatically disabled (enabled: false) and stamped with a disabled_reason. Re-enable it with a PATCH once the endpoint is healthy again; re-enabling resets the failure counter.

POST

webhook_endpoints

curl --request POST \
  --url https://api.tybritelabs.com/v1/webhook_endpoints \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "url": "https://yourapp.com/webhooks/tybrite",
  "events": [
    "order.paid",
    "order.fulfilled",
    "payment.succeeded"
  ],
  "enabled": true,
  "metadata": {
    "label": "production-erp",
    "owner": "platform-team"
  }
}
'

import requests

url = "https://api.tybritelabs.com/v1/webhook_endpoints"

payload = {
    "url": "https://yourapp.com/webhooks/tybrite",
    "events": ["order.paid", "order.fulfilled", "payment.succeeded"],
    "enabled": True,
    "metadata": {
        "label": "production-erp",
        "owner": "platform-team"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    url: 'https://yourapp.com/webhooks/tybrite',
    events: ['order.paid', 'order.fulfilled', 'payment.succeeded'],
    enabled: true,
    metadata: {label: 'production-erp', owner: 'platform-team'}
  })
};

fetch('https://api.tybritelabs.com/v1/webhook_endpoints', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/webhook_endpoints",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => 'https://yourapp.com/webhooks/tybrite',
    'events' => [
        'order.paid',
        'order.fulfilled',
        'payment.succeeded'
    ],
    'enabled' => true,
    'metadata' => [
        'label' => 'production-erp',
        'owner' => 'platform-team'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/webhook_endpoints"

	payload := strings.NewReader("{\n  \"url\": \"https://yourapp.com/webhooks/tybrite\",\n  \"events\": [\n    \"order.paid\",\n    \"order.fulfilled\",\n    \"payment.succeeded\"\n  ],\n  \"enabled\": true,\n  \"metadata\": {\n    \"label\": \"production-erp\",\n    \"owner\": \"platform-team\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/webhook_endpoints")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"url\": \"https://yourapp.com/webhooks/tybrite\",\n  \"events\": [\n    \"order.paid\",\n    \"order.fulfilled\",\n    \"payment.succeeded\"\n  ],\n  \"enabled\": true,\n  \"metadata\": {\n    \"label\": \"production-erp\",\n    \"owner\": \"platform-team\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/webhook_endpoints")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"url\": \"https://yourapp.com/webhooks/tybrite\",\n  \"events\": [\n    \"order.paid\",\n    \"order.fulfilled\",\n    \"payment.succeeded\"\n  ],\n  \"enabled\": true,\n  \"metadata\": {\n    \"label\": \"production-erp\",\n    \"owner\": \"platform-team\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "webhook_endpoint": {
    "id": "ac6737d6-12b9-446d-a6c4-1077493f498f",
    "url": "https://yourapp.com/webhooks/tybrite",
    "events": [
      "order.paid",
      "order.fulfilled"
    ],
    "enabled": true,
    "metadata": {
      "label": "production-erp"
    },
    "created_at": "2026-06-20T13:39:11.631+00:00",
    "updated_at": "2026-06-20T13:39:11.631+00:00",
    "signing_secret": "68c216748eb34be5adf93e39cda61386337883e7420c4a6d1994eb11346bce20"
  }
}

{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request parameters",
    "details": "The 'email' field is required"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid Authorization header"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "This operation requires a secret key. Publishable keys have read-only access."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key. Please slow down and try again shortly.",
    "remaining": 0,
    "reset": 1706198400
  }
}

{
  "error": {
    "code": "server_error",
    "message": "An unexpected error occurred"
  }
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: write operations, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Read-only access (GET requests only, plus POST semantic search)
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
All write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Body

application/json

url

string<uri>

required

HTTPS destination URL. HTTP is rejected.

Example:

"https://yourapp.com/webhooks/tybrite"

events

string[]

required

Array of event types to subscribe to. Use ["*"] for all events.

Order lifecycle: order.created, order.paid, order.fulfilled, order.shipped, order.cancelled, order.refunded, order.updated

Payment lifecycle: payment.succeeded, payment.failed, payment.refunded

Customer lifecycle: customer.created, customer.updated, customer.deleted

Inventory & catalog: product.created, product.updated, product.stock_low, product.out_of_stock

Cart & checkout: cart.created, cart.updated, cart.abandoned

Gift cards: gift_card.issued, gift_card.redeemed, gift_card.expired

Promotions: promotion.applied (a promotion was applied to a checkout), promotion.created, promotion.activated (a promotion went live), promotion.deactivated (a live promotion ended, was paused, or expired)

Content & collections: collection.created, collection.updated (a product collection was added or its homepage placement / banner changed), post.published, lookbook.published, review.approved (a review passed moderation and is now visible)

Store lifecycle & configuration: store.updated (the store's name, logo, branding, contact, or base currency changed — carries a changed_fields list), payment_provider.connected (a payment provider was connected), shipping_provider.connected (a shipping-rate provider was connected), channel.connected (a sales channel was connected)

Feature availability: feature.status_changed — a capability crossed from awaiting data to available (or the reverse), e.g. the store's first approved reviews arrive and reviews become usable. Carries feature, status, and previous_status. Use this to light up a storefront surface the moment its data exists. See the automation-webhooks guide.

Catalog sync & syndication: feed.sync.completed (a scheduled inbound feed-pull finished — carries created/updated/failed counts), channel.sync.completed (a sales-channel push to Google/Meta/… finished — carries pushed/rejected counts)

Wholesale (B2B): for stores with wholesale enabled — b2b.rfq.created, b2b.quote.sent, b2b.quote.accepted, b2b.quote.rejected, b2b.po.issued, b2b.po.confirmed, b2b.po.fulfilled, b2b.invoice.issued, b2b.invoice.paid, b2b.invoice.overdue

The store-lifecycle, content, and feature-availability events are designed for automation tools that keep a storefront in step with the store as it grows — the moment a promotion goes live, a collection becomes homepage-eligible, or a licensed capability gains its first data.

Example:

[
  "order.paid",
  "order.fulfilled",
  "payment.succeeded"
]

enabled

boolean

default:true

Whether the endpoint is active. Disabled endpoints are skipped on delivery.

metadata

object

Opaque key-value pairs for your own reference (not sent in deliveries).

Example:

{
  "label": "production-erp",
  "owner": "platform-team"
}

Response

Endpoint created

webhook_endpoint

object

Show child attributes

List webhook endpoints

Get a webhook endpoint

Create a webhook endpoint

curl --request POST \
  --url https://api.tybritelabs.com/v1/webhook_endpoints \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "url": "https://yourapp.com/webhooks/tybrite",
  "events": [
    "order.paid",
    "order.fulfilled",
    "payment.succeeded"
  ],
  "enabled": true,
  "metadata": {
    "label": "production-erp",
    "owner": "platform-team"
  }
}
'

import requests

url = "https://api.tybritelabs.com/v1/webhook_endpoints"

payload = {
    "url": "https://yourapp.com/webhooks/tybrite",
    "events": ["order.paid", "order.fulfilled", "payment.succeeded"],
    "enabled": True,
    "metadata": {
        "label": "production-erp",
        "owner": "platform-team"
    }
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    url: 'https://yourapp.com/webhooks/tybrite',
    events: ['order.paid', 'order.fulfilled', 'payment.succeeded'],
    enabled: true,
    metadata: {label: 'production-erp', owner: 'platform-team'}
  })
};

fetch('https://api.tybritelabs.com/v1/webhook_endpoints', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/webhook_endpoints",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => 'https://yourapp.com/webhooks/tybrite',
    'events' => [
        'order.paid',
        'order.fulfilled',
        'payment.succeeded'
    ],
    'enabled' => true,
    'metadata' => [
        'label' => 'production-erp',
        'owner' => 'platform-team'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/webhook_endpoints"

	payload := strings.NewReader("{\n  \"url\": \"https://yourapp.com/webhooks/tybrite\",\n  \"events\": [\n    \"order.paid\",\n    \"order.fulfilled\",\n    \"payment.succeeded\"\n  ],\n  \"enabled\": true,\n  \"metadata\": {\n    \"label\": \"production-erp\",\n    \"owner\": \"platform-team\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/webhook_endpoints")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"url\": \"https://yourapp.com/webhooks/tybrite\",\n  \"events\": [\n    \"order.paid\",\n    \"order.fulfilled\",\n    \"payment.succeeded\"\n  ],\n  \"enabled\": true,\n  \"metadata\": {\n    \"label\": \"production-erp\",\n    \"owner\": \"platform-team\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/webhook_endpoints")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"url\": \"https://yourapp.com/webhooks/tybrite\",\n  \"events\": [\n    \"order.paid\",\n    \"order.fulfilled\",\n    \"payment.succeeded\"\n  ],\n  \"enabled\": true,\n  \"metadata\": {\n    \"label\": \"production-erp\",\n    \"owner\": \"platform-team\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "webhook_endpoint": {
    "id": "ac6737d6-12b9-446d-a6c4-1077493f498f",
    "url": "https://yourapp.com/webhooks/tybrite",
    "events": [
      "order.paid",
      "order.fulfilled"
    ],
    "enabled": true,
    "metadata": {
      "label": "production-erp"
    },
    "created_at": "2026-06-20T13:39:11.631+00:00",
    "updated_at": "2026-06-20T13:39:11.631+00:00",
    "signing_secret": "68c216748eb34be5adf93e39cda61386337883e7420c4a6d1994eb11346bce20"
  }
}

{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request parameters",
    "details": "The 'email' field is required"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid Authorization header"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "This operation requires a secret key. Publishable keys have read-only access."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key. Please slow down and try again shortly.",
    "remaining": 0,
    "reset": 1706198400
  }
}

{
  "error": {
    "code": "server_error",
    "message": "An unexpected error occurred"
  }
}

Reference

System

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Search

Authentication

Customers

Gift Cards

Promotions

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Sandbox

Create a webhook endpoint

Authorizations

Body

Response