comecerodocs
Webhooks

Create an event subscription

POST
/event_subscriptions

Adds a webhook: from now on, each event of event_type is sent to destination by HTTP POST or email. Send active: true, because a new subscription is inactive by default. It only receives events of the mode of your token (test or live). Making one fires the event_subscription:created event. Secret and trusted tokens may call it; a limited token may not (403).

Authorization

headerAuthorizationBearer <token>

A secret, trusted or limited token. See Authentication.

Request Body

application/json
  1. body

The fields you can set on an event subscription. On create, event_type, method, format and destination are required. On update, send only the fields to change.

event_type*event_type

The kind of event. See the Webhooks section of this reference for when each one fires and what its data holds.

Value in"account:modified""cart:payment_completed""gateway:created""gateway:modified""event_subscription:created""event_subscription:modified""event_subscription:deleted""license_service:low_licenses""invoice:created""invoice:published""invoice:paid""invoice:payment_completed""order:created""order:payment_completed""order:fulfilled""order:licenses_assigned""payment:completed""payment:created_success""payment:created_failure""payment:captured_success""payment:captured_failure""payment:voided""product:created""product:modified""product:deleted""product:low_inventory""refund:created_success""refund:created_failure""refund:deleted""user:created""user:modified""shipment:created""shipment:modified""shipment:deleted""subscription:created""subscription:modified""subscription:cancelled""subscription:cancellation_scheduled""subscription:cancellation_unscheduled""subscription:completed""subscription:converted""subscription_item:added""subscription_item:cancelled""subscription_item:cancellation_scheduled""subscription_item:cancellation_unscheduled""subscription_item:modified""subscription:renewal_success""subscription:renewal_failure"
active?boolean

Whether events are sent. On create the default is false: send true to start receiving events.

Defaultfalse
method*string

http posts to a URL; email sends an email.

Value in"http""email"
format*string

The body format. html sends only data, as a readable table, and suits email.

Value in"json""xml""html"
destination*string

A URL when method is http (it must be a public address, not localhost or a private network), or an email address or comma-separated list of up to 6 addresses when method is email.

Lengthlength <= 256
timezone?|

An IANA time zone name for the dates in each event.

signature_key?|

Your own signing key, letters and digits only. Leave it out to sign with the account's signature key.

Match^[A-Za-z0-9]*$
Lengthlength <= 64
expand?|

Comma-separated child objects of data to send in full.

show?|

Comma-separated fields of data to send. Not with hide.

hide?|

Comma-separated fields of data to leave out. Not with show.

http_authorization_username?|

User name for HTTP Basic authorization on each delivery.

Lengthlength <= 75
http_authorization_password?|

Password for HTTP Basic authorization on each delivery.

Lengthlength <= 75
custom_header_name?|

The name of an extra header to send with each delivery.

Lengthlength <= 75
custom_header_value?|

The value of the extra header.

Lengthlength <= 256
environment_variables?|

Name and value pairs to pass to your endpoint in each event. On update this replaces the whole set.

comments?|

Your own notes.

Lengthlength <= 256

Response Body

The new event subscription.

application/json
  1. response

An endpoint that receives events of one type, by HTTP POST to a URL or by email. Make one event subscription for each event type you want.

object?"event_subscription"

Always event_subscription.

Value in"event_subscription"
url?string

The URL of this event subscription in the API.

Formaturi
event_subscription_id?string

The event subscription id.

date_created?string

When the event subscription was created.

Formatdate-time
date_modified?string

When the event subscription last changed.

Formatdate-time
test?boolean

true for a test mode event subscription. It only receives test mode events. Set by the token you create it with.

active?boolean

Whether events are sent to it. On create the default is false, so send active: true to start receiving events.

account_id?string

The account the event subscription belongs to.

event_type?event_type

The kind of event. See the Webhooks section of this reference for when each one fires and what its data holds.

Value in"account:modified""cart:payment_completed""gateway:created""gateway:modified""event_subscription:created""event_subscription:modified""event_subscription:deleted""license_service:low_licenses""invoice:created""invoice:published""invoice:paid""invoice:payment_completed""order:created""order:payment_completed""order:fulfilled""order:licenses_assigned""payment:completed""payment:created_success""payment:created_failure""payment:captured_success""payment:captured_failure""payment:voided""product:created""product:modified""product:deleted""product:low_inventory""refund:created_success""refund:created_failure""refund:deleted""user:created""user:modified""shipment:created""shipment:modified""shipment:deleted""subscription:created""subscription:modified""subscription:cancelled""subscription:cancellation_scheduled""subscription:cancellation_unscheduled""subscription:completed""subscription:converted""subscription_item:added""subscription_item:cancelled""subscription_item:cancellation_scheduled""subscription_item:cancellation_unscheduled""subscription_item:modified""subscription:renewal_success""subscription:renewal_failure"
destination?|

Where to send events: an https URL when method is http, or one email address or a comma-separated list when method is email. At most 256 characters. A URL must be a public address (not localhost or a private network).

format?|

The body format. json and xml send the whole event. html sends only data, as a readable table, and suits email.

Value in"json""xml""html"null
method?|

How to deliver. http is a POST to destination; email sends an email.

Value in"http""email"null
timezone?|

An IANA time zone name for the dates in the event, such as America/New_York. When null, the account's time zone is used.

signature_key?|

The key used to sign deliveries in the X-Comecero-Signature header. Letters and digits only, at most 64 characters. When null, the account's signature key (Settings, Technical) is used.

expand?|

Comma-separated child objects of data to send in full, as with the expand query parameter, for example customer,payments.

show?|

Comma-separated fields of data to send; all others are left out. You cannot set both show and hide.

hide?|

Comma-separated fields of data to leave out. You cannot set both show and hide.

http_authorization_username?|

A user name sent with HTTP Basic authorization on each delivery. At most 75 characters. Only returned when method is http.

http_authorization_password?|

The password for HTTP Basic authorization. At most 75 characters. It is returned as you set it, so keep secret and trusted tokens safe. Only returned when method is http.

custom_header_name?|

The name of an extra header sent with each delivery. At most 75 characters. Sent only when custom_header_value is set too.

custom_header_value?|

The value of the extra header. At most 256 characters.

environment_variables?|

Name and value pairs copied into environment_variables of every event sent to this subscription.

comments?|

Your own notes. At most 256 characters.

formatted?

Dates as display text. Only returned with formatted=true.

curl -X POST 'https://api.comecero.com/api/v1/event_subscriptions' \  -H 'Content-Type: application/json' \  -d '{  "event_type": "order:created",  "method": "http",  "format": "json",  "destination": "https://example.com/webhooks/comecero",  "active": true}'
Example Response
{  "object": "event_subscription",  "url": "https://api.comecero.com/api/v1/event_subscriptions/1102610913420ES4f9QmLp",  "event_subscription_id": "1102610913420ES4f9QmLp",  "date_created": "2026-11-07T14:20:03Z",  "date_modified": "2026-11-07T14:20:03Z",  "test": true,  "active": true,  "account_id": "AB1234",  "event_type": "order:created",  "destination": "https://example.com/webhooks/comecero",  "format": "json",  "method": "http",  "timezone": null,  "signature_key": null,  "expand": "customer",  "show": null,  "hide": null,  "http_authorization_username": null,  "http_authorization_password": null,  "custom_header_name": null,  "custom_header_value": null,  "environment_variables": {    "store": "main"  },  "comments": "Order sync"}

List event subscriptions GET

Lists your event subscriptions (webhooks). Subscriptions made by an installed app are not listed. The list is offset-based. Secret and trusted tokens may call it; a limited token may not (`403`).

Get an event subscription GET

Gets one event subscription, including its `signature_key` and HTTP authorization details. One made by an installed app answers `403`. Secret and trusted tokens may call it; a limited token may not (`403`).