Managing Webhooks

List All Webhooks

curl https://api.inflowpay.xyz/api/webhook \
  -H "X-Inflow-Api-Key: inflow_prod_your_key"

Response:

[
  {
    "webhookId": "webhook_abc123",
    "webhookUrl": "https://yourserver.com/webhooks/inflow"
  }
]

Get a Specific Webhook

curl https://api.inflowpay.xyz/api/webhook/{webhookId} \
  -H "X-Inflow-Api-Key: inflow_prod_your_key"

Check Webhook Status

See whether a webhook is active or has failures:

curl https://api.inflowpay.xyz/api/webhook/{webhookId}/status \
  -H "X-Inflow-Api-Key: inflow_prod_your_key"

Response:

{
  "webhookId": "webhook_abc123",
  "webhookUrl": "https://yourserver.com/webhooks/inflow",
  "status": "enabled",
  "failureReason": null
}

Status Values

Status	Description
`enabled`	Webhook is active and receiving events
`disabled`	Webhook has been manually disabled

If your endpoint consistently fails to respond with a 200 status, Inflow may disable it. The failureReason field will explain why.

Enable or Disable a Webhook

# Disable
curl -X PATCH https://api.inflowpay.xyz/api/webhook/{webhookId} \
  -H "X-Inflow-Api-Key: inflow_prod_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "status": "disabled" }'

# Re-enable
curl -X PATCH https://api.inflowpay.xyz/api/webhook/{webhookId} \
  -H "X-Inflow-Api-Key: inflow_prod_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "status": "enabled" }'

Get signing secret

Retrieve the Svix signing secret for an endpoint (for signature verification):

curl https://api.inflowpay.xyz/api/webhook/{webhookId}/secret \
  -H "X-Inflow-Api-Key: inflow_prod_your_key"

{
  "webhookId": "webhook_abc123",
  "secret": "whsec_…"
}

Update subscribed event types

Replace the full list of event types this endpoint receives (see Overview & event types):

curl -X PATCH https://api.inflowpay.xyz/api/webhook/{webhookId}/event-types \
  -H "X-Inflow-Api-Key: inflow_prod_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "eventTypes": [
      "connect.payment.authorized",
      "connect.payment.settled"
    ]
  }'

Marketplaces use connect.* names. Direct merchants use unprefixed names (payment.settled, etc.). An empty array subscribes to all events.

Delete a Webhook

curl -X DELETE https://api.inflowpay.xyz/api/webhook/{webhookId} \
  -H "X-Inflow-Api-Key: inflow_prod_your_key"

Response:

{
  "message": "Webhook deleted successfully"
}

API Summary

Action	Method	Endpoint
Create webhook	`POST`	`/api/webhook`
List webhooks	`GET`	`/api/webhook`
List event types (direct only)	`GET`	`/api/webhook/event-types`
List sent events	`GET`	`/api/webhook/events`
Replay an event	`POST`	`/api/webhook/events/{eventId}/replay`
Event delivery status	`GET`	`/api/webhook/events/{eventId}/delivery`
Get webhook	`GET`	`/api/webhook/{webhookId}`
Get signing secret	`GET`	`/api/webhook/{webhookId}/secret`
Get status	`GET`	`/api/webhook/{webhookId}/status`
Update status	`PATCH`	`/api/webhook/{webhookId}`
Update event types	`PATCH`	`/api/webhook/{webhookId}/event-types`
Delete webhook	`DELETE`	`/api/webhook/{webhookId}`

All webhook endpoints require the private API key (X-Inflow-Api-Key). Webhook management is API-only — it is not available from the Dashboard.

Limits

Maximum 5 webhooks per account.
Each webhook URL must be unique within your account.
URLs must use HTTPS.

Retry & Failure Policy

If your endpoint does not respond with a 2xx within 15 seconds, Inflow retries with exponential backoff — up to 10 attempts spread over several hours to days. If all retries fail, the webhook is automatically disabled.

Check the webhook status endpoint and the failureReason field to diagnose issues. Once fixed, re-enable the webhook via the update status endpoint.