OpenPoly logo
Dashboard

Webhook endpoints

Configure webhook endpoints, events, and replay workflows.

Webhook endpoints

Dashboard webhook settings control where OpenPoly sends callback events.

Configure endpoint

For each endpoint record define:

  • destination URL
  • subscribed events
  • shared secret
  • max attempts
  • timeout seconds

Rules:

  • HTTPS required except allowed localhost testing cases
  • secret never shown back in API response
  • disabled endpoint receives no new deliveries
  • empty enabled_events means subscribe to all current event types
  • max_attempts defaults to 6 and is capped at 10
  • timeout_seconds defaults to 5 and is capped at 30

The dashboard editor starts from the endpoint's saved URL and exact event selection; it does not replace a saved secret unless a new secret is entered. Choose from all ten Opinion and eight Polyflight names. Existing selections remain intact when editing other fields.

Event subscription strategy

Start with minimum set needed by operator systems.

Common starting set:

  • mini_app.trade.processed
  • mini_app.trade.failed
  • mini_app.redemption.processed
  • mini_app.redemption.failed
  • mini_app.payout.pending

For Polyflight, select mini_app.polyflight.purchase.processed, mini_app.polyflight.purchase.failed, and the relevant ticket, payout, refund, and compensation events. Pending payout/refund means money owed, not money credited. The fee on a purchase is part of the stake debit; a cancelled ticket is refunded the full stake.

Full list: /docs/webhooks/event-types

Replay workflow

  1. inspect failed or dead-letter delivery
  2. fix receiver issue or secret mismatch
  3. replay delivery from dashboard
  4. confirm latest attempt becomes sent

Replay does not create new business event.

Replaying a successful 2xx delivery sends the same callback event again and must be safe because your receiver durably dedupes by event_id.

Delete flow

Dashboard uses:

POST /api/operator/webhooks/endpoints/{id}/delete

This is a compatibility fallback for environments where dynamic DELETE routes are unreliable. The REST DELETE /api/operator/webhooks/endpoints/{id} route also exists.

Disable flow

Disable endpoint when:

  • receiver under maintenance
  • secret suspected leaked
  • endpoint moved to new path

Re-enable only after smoke test on fixed receiver.

Troubleshooting cues

  • repeated 401 -> secret mismatch or bad raw-body handling
  • repeated 500 -> receiver app failing after verification
  • dead_letter -> retries exhausted, operator action required
Copyright © 2026