Webhooks

Merchant-public status: Events GET list/retrieve and WebhookEndpoint management are contracted-test. Unsupported Events methods remain unsupported.

Register endpoints with a Fluveo merchant secret key. The server chooses the merchant and mode before parsing management input. Stored endpoints, delivery, retries, and automatic disable all use that same owner and mode.

Manage endpoints

Create and list endpoints at /v1/webhook_endpoints. Retrieve, update, and delete one endpoint with its we_* id. Secret rotation uses POST /v1/webhook_endpoints/{endpoint_id}/rotate_secret and is clearly a Fluveo extension, not a Stripe operation.

Each endpoint has its own whsec_* secret and event filter. The full secret is returned only on create and rotation. Normal reads show a fixed redacted marker, update omits the field, and logs do not print the secret.

Unknown, malformed, foreign-owner, and wrong-mode ids all return the same resource-missing response without repeating the supplied id.

Verify a signature

Verify the raw request bytes before parsing JSON. Enforce timestamp tolerance, compare signatures in constant time, and keep real secrets out of source and logs. The Node, Python, and Go packages include helpers for this work.

Delivery safety

Fluveo checks the endpoint URL at registration and before each delivery. The sender pins checked addresses, ignores proxies, refuses redirects, and blocks private or internal destinations. The local-host exception exists only in separate dev images and is absent from release builds.

Retries keep the original event body, owner, and mode. An event with no proven owner reaches no endpoint. Repeated failure disables only the failing endpoint.

Use the generated API Reference for the exact public methods and schemas.