API Reference
Webhooks overview
Receive signed, at-least-once-compatible inquiry notifications.
When to use webhooks
Use webhooks to react to inquiry decisions without polling. Always keep the status endpoint as a reconciliation path.
Security model
- HTTPS endpoints only.
- Signing secret
whsec_...shown once. X-Zippy-Signature: sha256=<hex>over exact raw JSON body (not Stripe t=,v1=).- Also receive
X-Zippy-Webhook-IdandX-Zippy-Delivery-Id.
Create an endpoint
Register endpoints in the dashboard (Developer → Webhooks). Then subscribe events on the published template revision. See manage endpoints.
Delivery flow
Inquiry event
A status changes
Outbox
Event is recorded
subscribed
Signed request
POST to your endpoint
response
2xx · Delivered
Failure · Inspect
Failed deliveries can be resent from the dashboard.
Receiver checklist
- Idempotent handlers keyed by event id / delivery id.
- Raw body signature verification.
- Branch on
data._test === truefor sandbox tests. - Respond quickly within the 10s default timeout.