Webhook endpoints
Webhook endpoints
Dashboard webhook settings control where OpenPoly sends callback events.
Configure endpoint
For each endpoint record define:
- destination URL
- subscribed events
- shared secret
- max attempts
- timeout seconds
Rules:
- HTTPS required except allowed localhost testing cases
- secret never shown back in API response
- disabled endpoint receives no new deliveries
- empty
enabled_eventsmeans subscribe to all current event types max_attemptsdefaults to6and is capped at10timeout_secondsdefaults to5and is capped at30
The dashboard editor starts from the endpoint's saved URL and exact event selection; it does not replace a saved secret unless a new secret is entered. Choose from all ten Opinion and eight Polyflight names. Existing selections remain intact when editing other fields.
Event subscription strategy
Start with minimum set needed by operator systems.
Common starting set:
mini_app.trade.processedmini_app.trade.failedmini_app.redemption.processedmini_app.redemption.failedmini_app.payout.pending
For Polyflight, select mini_app.polyflight.purchase.processed, mini_app.polyflight.purchase.failed, and the relevant ticket, payout, refund, and compensation events. Pending payout/refund means money owed, not money credited. The fee on a purchase is part of the stake debit; a cancelled ticket is refunded the full stake.
Full list: /docs/webhooks/event-types
Replay workflow
- inspect failed or dead-letter delivery
- fix receiver issue or secret mismatch
- replay delivery from dashboard
- confirm latest attempt becomes
sent
Replay does not create new business event.
Replaying a successful 2xx delivery sends the same callback event again and must be safe because your receiver durably dedupes by event_id.
Delete flow
Dashboard uses:
POST /api/operator/webhooks/endpoints/{id}/delete
This is a compatibility fallback for environments where dynamic DELETE routes are unreliable. The REST DELETE /api/operator/webhooks/endpoints/{id} route also exists.
Disable flow
Disable endpoint when:
- receiver under maintenance
- secret suspected leaked
- endpoint moved to new path
Re-enable only after smoke test on fixed receiver.
Troubleshooting cues
- repeated
401-> secret mismatch or bad raw-body handling - repeated
500-> receiver app failing after verification dead_letter-> retries exhausted, operator action required
Related pages
- operator API contract:
/docs/operator-api/webhook-endpoints - delivery inspection:
/docs/operator-api/webhook-deliveries - delivery dashboard:
/docs/dashboard/webhook-deliveries - retry semantics:
/docs/webhooks/retry-and-replay
