Get an event subscription
Gets one event subscription, including its signature_key and HTTP authorization details. One made by an installed app answers 403. Secret and trusted tokens may call it; a limited token may not (403).
AuthorizationBearer <token>A secret, trusted or limited token. See Authentication.
event_subscription_id*stringThe event subscription id.
timezone?stringAn IANA time zone name, such as America/New_York or UTC. It sets how date_start and date_end are read and the time zone of every date in the response. The default is the account's time zone (Settings, Technical), or UTC when it has none. A name that is not known is a 400.
show?stringComma-separated fields to return; all others are left out. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
hide?stringComma-separated fields to leave out of the response. Use dot notation for child fields (customer.email). You cannot send show and hide together (400). See Customizing output.
formatted?booleanWhen true, the object also has a formatted child with amounts and dates as display text in the shopper's language and currency (for example $19.99 or November 7, 2026). The default is false. See Localized formatting.
falseThe event subscription.
application/json- response
An endpoint that receives events of one type, by HTTP POST to a URL or by email. Make one event subscription for each event type you want.
object?"event_subscription"Always event_subscription.
"event_subscription"url?stringThe URL of this event subscription in the API.
urievent_subscription_id?stringThe event subscription id.
date_created?stringWhen the event subscription was created.
date-timedate_modified?stringWhen the event subscription last changed.
date-timetest?booleantrue for a test mode event subscription. It only receives test mode events. Set by the token you create it with.
active?booleanWhether events are sent to it. On create the default is false, so send active: true to start receiving events.
account_id?stringThe account the event subscription belongs to.
event_type?event_typeThe kind of event. See the Webhooks section of this reference for when each one fires and what its data holds.
"account:modified""cart:payment_completed""gateway:created""gateway:modified""event_subscription:created""event_subscription:modified""event_subscription:deleted""license_service:low_licenses""invoice:created""invoice:published""invoice:paid""invoice:payment_completed""order:created""order:payment_completed""order:fulfilled""order:licenses_assigned""payment:completed""payment:created_success""payment:created_failure""payment:captured_success""payment:captured_failure""payment:voided""product:created""product:modified""product:deleted""product:low_inventory""refund:created_success""refund:created_failure""refund:deleted""user:created""user:modified""shipment:created""shipment:modified""shipment:deleted""subscription:created""subscription:modified""subscription:cancelled""subscription:cancellation_scheduled""subscription:cancellation_unscheduled""subscription:completed""subscription:converted""subscription_item:added""subscription_item:cancelled""subscription_item:cancellation_scheduled""subscription_item:cancellation_unscheduled""subscription_item:modified""subscription:renewal_success""subscription:renewal_failure"destination?|Where to send events: an https URL when method is http, or one email address or a comma-separated list when method is email. At most 256 characters. A URL must be a public address (not localhost or a private network).
format?|The body format. json and xml send the whole event. html sends only data, as a readable table, and suits email.
"json""xml""html"nullmethod?|How to deliver. http is a POST to destination; email sends an email.
"http""email"nulltimezone?|An IANA time zone name for the dates in the event, such as America/New_York. When null, the account's time zone is used.
signature_key?|The key used to sign deliveries in the X-Comecero-Signature header. Letters and digits only, at most 64 characters. When null, the account's signature key (Settings, Technical) is used.
expand?|Comma-separated child objects of data to send in full, as with the expand query parameter, for example customer,payments.
show?|Comma-separated fields of data to send; all others are left out. You cannot set both show and hide.
hide?|Comma-separated fields of data to leave out. You cannot set both show and hide.
http_authorization_username?|A user name sent with HTTP Basic authorization on each delivery. At most 75 characters. Only returned when method is http.
http_authorization_password?|The password for HTTP Basic authorization. At most 75 characters. It is returned as you set it, so keep secret and trusted tokens safe. Only returned when method is http.
custom_header_name?|The name of an extra header sent with each delivery. At most 75 characters. Sent only when custom_header_value is set too.
custom_header_value?|The value of the extra header. At most 256 characters.
environment_variables?|Name and value pairs copied into environment_variables of every event sent to this subscription.
comments?|Your own notes. At most 256 characters.
formatted?Dates as display text. Only returned with formatted=true.
curl -X GET 'https://api.comecero.com/api/v1/event_subscriptions/string'{ "object": "event_subscription", "url": "https://api.comecero.com/api/v1/event_subscriptions/1102610913420ES4f9QmLp", "event_subscription_id": "1102610913420ES4f9QmLp", "date_created": "2026-11-07T14:20:03Z", "date_modified": "2026-11-07T14:20:03Z", "test": true, "active": true, "account_id": "AB1234", "event_type": "order:created", "destination": "https://example.com/webhooks/comecero", "format": "json", "method": "http", "timezone": null, "signature_key": null, "expand": "customer", "show": null, "hide": null, "http_authorization_username": null, "http_authorization_password": null, "custom_header_name": null, "custom_header_value": null, "environment_variables": { "store": "main" }, "comments": "Order sync"}Create an event subscription POST
Adds a webhook: from now on, each event of `event_type` is sent to `destination` by HTTP POST or email. Send `active: true`, because a new subscription is inactive by default. It only receives events of the mode of your token (test or live). Making one fires the `event_subscription:created` event. Secret and trusted tokens may call it; a limited token may not (`403`).
Update an event subscription POST
Changes the fields you send and leaves the others as they are. Send `active: false` to pause deliveries. Events already made keep the data they were made with, but are sent with the subscription's current destination and settings. Fires the `event_subscription:modified` event. Answers `201`, not `200`. Secret and trusted tokens may call it; a limited token may not (`403`).