{
"url": "https://yourapp.com/webhooks/boh",
"events": [
"inventory_transaction.completed",
"inventory_transaction.failed",
"purchase_order.status_changed"
]
}
{
"endpoint": {
"id": "wep_01j5k...",
"url": "https://yourapp.com/webhooks/boh",
"events": [
"inventory_transaction.completed",
"inventory_transaction.failed",
"purchase_order.status_changed"
],
"is_active": true,
"disabled_reason": null,
"consecutive_failures": 0,
"created_at": "2026-08-07T14:30:00.000Z",
"updated_at": "2026-08-07T14:30:00.000Z"
},
"secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxx"
}
{
"error": {
"kind": "webhook_limit_exceeded",
"message": "Account has reached the maximum of 10 webhook endpoints"
}
}
Webhooks
Create webhook
Registers a new webhook endpoint. The response includes the signing secret — store it securely, it is shown only once.
POST
/
api
/
v1
/
public
/
admin
/
webhooks
{
"url": "https://yourapp.com/webhooks/boh",
"events": [
"inventory_transaction.completed",
"inventory_transaction.failed",
"purchase_order.status_changed"
]
}
{
"endpoint": {
"id": "wep_01j5k...",
"url": "https://yourapp.com/webhooks/boh",
"events": [
"inventory_transaction.completed",
"inventory_transaction.failed",
"purchase_order.status_changed"
],
"is_active": true,
"disabled_reason": null,
"consecutive_failures": 0,
"created_at": "2026-08-07T14:30:00.000Z",
"updated_at": "2026-08-07T14:30:00.000Z"
},
"secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxx"
}
{
"error": {
"kind": "webhook_limit_exceeded",
"message": "Account has reached the maximum of 10 webhook endpoints"
}
}
string
required
BOH API key with
admin:webhooks scope.string
required
HTTPS URL that will receive POST requests. Must start with
https://.string[]
required
One or more event types to subscribe to. Supported events:
inventory_transaction.completedinventory_transaction.failedpurchase_order.status_changedapi_key.expiringping
object
The created endpoint:
id, url, events, is_active, disabled_reason, consecutive_failures, created_at, updated_at.string
Signing secret (
whsec_...). Shown only once. Store it in your secrets manager immediately. Use it to verify the X-BOH-Signature header on incoming requests.{
"url": "https://yourapp.com/webhooks/boh",
"events": [
"inventory_transaction.completed",
"inventory_transaction.failed",
"purchase_order.status_changed"
]
}
{
"endpoint": {
"id": "wep_01j5k...",
"url": "https://yourapp.com/webhooks/boh",
"events": [
"inventory_transaction.completed",
"inventory_transaction.failed",
"purchase_order.status_changed"
],
"is_active": true,
"disabled_reason": null,
"consecutive_failures": 0,
"created_at": "2026-08-07T14:30:00.000Z",
"updated_at": "2026-08-07T14:30:00.000Z"
},
"secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxx"
}
{
"error": {
"kind": "webhook_limit_exceeded",
"message": "Account has reached the maximum of 10 webhook endpoints"
}
}