Appearance
Register a webhook
POST
/programs/{id}/webhooks
The response carries the signing secret ONCE. url must be https and must resolve to a public address. An empty program or location filter means ALL — see the webhook guide.
Authorizations
ApiKeyBearer
A shop-scoped API key created in the dashboard and shown exactly once. An MCP tmk_ key presented here returns a 401 that names the mistake.
Type
HTTP (bearer)
Parameters
Header Parameters
Idempotency-Key
Makes a retry safe: a repeat with the same key and body replays the stored response; the same key with a different body is a 409. Keys are remembered for 24h (IDEMPOTENCY_DEDUPE_WINDOW_HOURS). A request without the header is processed normally.
Type
string
Max Length
255Path Parameters
id*
An opaque id. The API never promises an id format.
Type
Requiredstring
Request Body
application/json
JSON "url": "https://hooks.example.com/tesserapp", "events": [ "stamp.assigned" ], "bearer_token": "a-token-your-receiver-checks", "active": true, "description": "CRM sync — production receiver", "program_ids": [ "prg_docsfixture0001" ], "location_ids": [ "loc_docsfixture0001" ], "include_shop_wide_events": true, "http_method": "POST", "custom_headers": { "X-Partner-Token": "a-value-only-your-receiver-knows" }
{
}
Responses
Register a webhook
application/json
JSON "id": "whk_docsfixture0001", "shop_id": "shp_docsfixture0001", "program_id": "prg_docsfixture0001", "url": "https://hooks.example.com/tesserapp", "events": [ "stamp.assigned" ], "active": true, "description": "CRM sync — production receiver", "has_bearer_token": true, "program_ids": [ "prg_docsfixture0001" ], "location_ids": [ "loc_docsfixture0001" ], "include_shop_wide_events": true, "http_method": "POST", "custom_headers": { "X-Partner-Token": "••••" }, "payload_version": "v1", "consecutive_failures": 0, "created_at": "2026-08-05T10:15:00.000Z", "updated_at": "2026-09-04T10:15:00.000Z", "secret": "whsec_docs_fixture_secret_do_not_use_in_production"
{
}
POST
/programs/{id}/webhooks