Drive your own panel from customer, payment, order, invoice, service and ticket lifecycle events.
Verify the HMAC signature against the raw body, reject stale timestamps, store the event identifier, return 2xx, then process idempotently.
| Method | Path | Required scope | Description |
|---|---|---|---|
| GET/POST | /workspace/webhooks | webhooks:read/write | List endpoints or create a signed public-HTTPS endpoint. |
| PATCH/DELETE | /workspace/webhooks/{webhook_ref} | webhooks:write | Update subscriptions and state or delete the endpoint. |
| GET | /workspace/webhooks/{webhook_ref}/deliveries | webhooks:read | Inspect bounded delivery metadata and retry state. |
| POST | /workspace/webhooks/{webhook_ref}/test | webhooks:write | Queue a test only for this endpoint. |
| POST | /workspace/webhooks/{webhook_ref}/replay | webhooks:write | Replay one owned delivery as a new signed attempt. |
| POST | /workspace/webhooks/{webhook_ref}/rotate-secret | webhooks:write | Rotate the secret; the replacement is returned once. |
X-Phylex-Delivery: <delivery UUID>
X-Phylex-Event: payment.succeeded
X-Phylex-Signature: t=1789062000,v1=<hex hmac-sha256(timestamp + "." + raw_body)>