Webhooks overview

Register a subscription for the events you care about. When a matching event occurs, Endl either pushes it to your endpoint or holds it for you to poll.

Delivery modes

Mode	How it works	You host
`PUSH`	Endl sends each event to your HTTPS endpoint as a signed `POST`, with retries. The default.	A receiver
`PULL`	Endl delivers nothing. You poll the event feed and checkpoint a cursor.	Nothing

Subscriptions are PUSH or PULL only. SQS and SSE are reserved but not yet available — requesting either returns 422.

Base URL

Environment	Base URL
Sandbox	`https://api-sandbox.endl.io`
Production	Issued at onboarding

All webhook endpoints live under /api/v0.

Quickstart

1. Create a subscription. Register your receiver URL and the event types you want. The response returns your signing secret once — store it before moving on. There is no way to read it back and no rotate endpoint; if it is lost, delete the subscription and create a new one.

curl -X POST https://api-sandbox.endl.io/api/v0/webhooks/subscriptions \
  -H "Api-Version: 2026-09.1" \
  -H "API-KEY: $ENDL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target": "https://api.acme.com/webhooks/endl",
    "eventFilter": ["payout.completed", "payout.failed"]
  }'

2. Receive and verify. Endl POSTs each event with an X-WEBHOOK-SIGNATURE header. Verify it against the raw request body before trusting the payload. 3. Inspect deliveries. Every attempt is recorded — list them, drill into one, or retry the ones that failed.

Conventions

Convention	Detail
Identity	Comes from your API key. You only ever see and manage your own subscriptions and deliveries — there is no partner field in any request body.
Response shape	Service responses use the shared envelope — `{ code, message, status, data, errors }`. Errors raised at the edge use two other shapes.
Timestamps	ISO-8601 UTC, three fraction digits — `2026-09-02T12:34:56.789Z`.
Permissions	Subscription and delivery endpoints need `webhooks`; the PULL feed needs `events`. A key without the permission is a `403`.
Rate limit	60 requests per minute per key by default, then `429` with `X-RateLimit-Limit` and `X-RateLimit-Remaining`.
Versioning	Every request sends `Api-Version: 2026-09.1`, echoed on the response. See Versioning.
Correlation	Every response carries `X-Request-ID` — except a `401`, which carries none. Quote it to support and it joins straight to our logs.

Introduction

Endpoints

Webhooks overview

Delivery modes

Base URL

Quickstart

Conventions

Where to next

Verifying signatures

Create subscription

List deliveries

Event catalogue

​Delivery modes

​Base URL

​Quickstart

​Conventions

​Where to next

Verifying signatures

Create subscription

List deliveries

Event catalogue

Delivery modes

Base URL

Quickstart

Conventions

Where to next