Webhooks

Endpoints

POST /v1/webhook-endpoints
{
  "url": "https://your-site.com/webhooks/strimz",
  "events": ["payment.completed", "subscription.charged"],
  "mode": "live",
  "description": "Production receiver"
}

Returns:

{
  "endpoint": {
    "id": "cmq4wsb5n000dje6l4y8k2rzc",
    "url": "https://your-site.com/webhooks/strimz",
    "events": ["payment.completed", "subscription.charged"],
    "mode": "live",
    "status": "active",
    "signingSecretPrefix": "whsec_abcdef",
    ...
  },
  "signingSecret": "whsec_xxxxxxxxxxxxxxxxxxxx"
}

signingSecret is shown only once. Save it into your secrets manager before you close the response.

GET  /v1/webhook-endpoints/{id}
GET  /v1/webhook-endpoints
POST /v1/webhook-endpoints/{id}/disable
POST /v1/webhook-endpoints/{id}/enable
POST /v1/webhook-endpoints/{id}/rotate-secret

Deliveries

GET /v1/webhook-deliveries/{id}
GET /v1/webhook-deliveries?endpointId=cmq4wsb5n000dje6l4y8k2rzc&status=retrying,permanently_failed

Deliveries also filter by eventName (for example payment.completed) and by from and to. See List filters.

POST /v1/webhook-deliveries/{id}/replay

Replay puts the delivery back on the queue. Handy for debugging a receiver: fix the bug, replay the last few failures, watch them land.

SSRF guard

Endpoint URLs must:

• Use https://
• Not resolve to a private (RFC 1918), loopback, link-local, CGNAT, multicast, benchmarking (198.18.0.0/15), documentation, or other reserved address. IPv6 addresses are checked too, including unique-local, NAT64, and IPv4-mapped addresses such as ::ffff:10.0.0.1.
• Be DNS-resolvable at registration time

The check runs again on every delivery, so an endpoint that starts resolving to internal infra later (DNS rebinding) gets blocked at send time. Strimz connects to the exact address it checked, and it does not follow redirects: a 3xx response counts as a failed attempt and is retried like any other failure. Point your endpoint URL at the final address.

Auto-disable

5+ permanent failures in a 24-hour window → endpoint flips to disabled automatically. Re-enable from the dashboard once your server is back online.

See the Webhooks guide for signature verification.