Skip to main content
POST
Register Webhook

Authorizations

Authorization
string
header
required

API key of the form ec_(live|test). Scopes are listed per operation.

Headers

X-Signature
string
required

HMAC-SHA256 signature over method, path, timestamp, nonce and raw body.

X-Timestamp
string
required

Unix epoch seconds. Requests outside the tolerance window are rejected.

X-Nonce
string
required

Unique per-request nonce. Replays are rejected.

Body

application/json
url
string<uri>
required

HTTPS endpoint; must not target a private host/IP.

events
enum<string>[]
required
Minimum array length: 1
Available options:
journey.initiated,
journey.updated,
journey.completed,
journey.rejected,
journey.failed

Response

Success

Returned on create. The plaintext secret is shown ONCE — store it now.

success
boolean
required
data
object
required