Webhook endpoints

Manage webhook endpoints for authenticated operator.

Paths

• GET /api/operator/webhooks/endpoints
• POST /api/operator/webhooks/endpoints
• PATCH /api/operator/webhooks/endpoints/{id}

Required scopes

• webhooks:read
• webhooks:write

Create body

{
  "url": "https://operator.example/webhooks/openpoly",
  "secret": "whsec_...",
  "enabled_events": [
    "mini_app.trade.processed",
    "mini_app.trade.failed"
  ],
  "max_attempts": 6,
  "timeout_seconds": 5
}

Rules

• HTTPS required except localhost or 127.0.0.1
• invalid events -> 400 INVALID_ENABLED_EVENTS
• patch status must be active or disabled
• response exposes has_secret, never raw secret

Response fields

• id
• url
• status
• enabled_events
• max_attempts
• timeout_seconds
• has_secret
• created_at
• updated_at