Delete webhook endpoint
Soft-deletes a webhook endpoint — deliveries stop immediately. The record is preserved for audit (deletedAt is set). Issue a new endpoint if you need to resume deliveries.
curl -X DELETE "https://<api-host>/v1/webhooks/endpoints/string"Create webhook endpoint
Creates a new webhook endpoint bound to the caller owner scope (merchant, tenant, or platform). The HMAC signing secret is returned ONCE in this response — store it securely. Subscribed `events` must exist in the catalog and be visible to the caller. URL must use HTTPS. Optional `maxAttempts` (1-20) overrides the platform delivery attempt budget for this endpoint; omit it to use the default.
Get webhook endpoint
Returns a single webhook endpoint by ID. Ownership is verified against the caller scope. The signing secret is never returned on read — use POST .../rotate-secret to generate a new one.