Admin API

Webhooks

Subscriptions to store events and their delivery log.

GETWebhook subscriptions (an app token sees only its own)
POSTSubscribe a URL to topics; the signing secret is shown once
PATCHChange the URL or topics, or pause and resume
DELRemove a subscription
GETDelivery log, newest first
POSTSend a delivery again now
POSTSend a webhook.test event to this URL now

Webhook subscriptions (an app token sees only its own)

GET/admin/2026-11/webhooks

scope read_webhooks

Query parameters

limitinteger
Items per page, 1 to 250.
Default 50 · 1 to 250
afterstring
Cursor from a previous next_cursor.
Up to 512 characters
app_idID (app_...)

Response 200

dataarray of objectrequired
data[].idID (whs_...)required
data[].app_idID (app_...)required
data[].urlstringrequired
data[].topicsarray of enumrequired
One of order.created order.paid order.cancelled order.fulfilled order.refunded refund.processed refund.failed product.created product.updated product.deleted inventory.low inventory.out_of_stock customer.created customer.updated checkout.completed
data[].api_versionstringrequired
data[].statusenumrequired
One of active paused
data[].paused_reasonstring or nullrequired
data[].delivery_ratenumber or nullrequired
Share of deliveries in the last 7 days that succeeded.
data[].created_attimestamprequired
has_morebooleanrequired
next_cursorstring or nullrequired

Errors

400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl https://api.storelyne.com/admin/2026-11/webhooks \
  -H "Authorization: Bearer pat_live_..."

const res = await fetch('https://api.storelyne.com/admin/2026-11/webhooks', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
  },
});
const data = await res.json();

Response 200

{
  "data": [
    {
      "id": "whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
      "app_id": "app_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
      "url": "https://example.com",
      "topics": [
        "order.created"
      ],
      "api_version": "string",
      "status": "active",
      "paused_reason": "string",
      "delivery_rate": 1,
      "created_at": "2026-11-04T10:00:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": "eyJpZCI6Ii4uLiJ9"
}

Subscribe a URL to topics; the signing secret is shown once

POST/admin/2026-11/webhooks

scope write_webhooksIdempotency-Key required

Headers

Idempotency-Keystringrequired
Unique key for this request. Retries with the same key return the first response.
At least 1 characters · Up to 255 characters
X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Request body

app_idID (app_...)
Required with a seller session; an app token always uses its own app.
urlstringrequired
Up to 500 characters
topicsarray of enumrequired
One of order.created order.paid order.cancelled order.fulfilled order.refunded refund.processed refund.failed product.created product.updated product.deleted inventory.low inventory.out_of_stock customer.created customer.updated checkout.completed
Up to 15 items

Response 201

webhookobjectrequired
webhook.idID (whs_...)required
webhook.app_idID (app_...)required
webhook.urlstringrequired
webhook.topicsarray of enumrequired
One of order.created order.paid order.cancelled order.fulfilled order.refunded refund.processed refund.failed product.created product.updated product.deleted inventory.low inventory.out_of_stock customer.created customer.updated checkout.completed
webhook.api_versionstringrequired
webhook.statusenumrequired
One of active paused
webhook.paused_reasonstring or nullrequired
webhook.delivery_ratenumber or nullrequired
Share of deliveries in the last 7 days that succeeded.
webhook.created_attimestamprequired
secretstringrequired
Shown only once.

Errors

400	`idempotency_key_required`	Every POST needs an Idempotency-Key header.
400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
422	`idempotency_key_reused`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X POST https://api.storelyne.com/admin/2026-11/webhooks \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com",
  "topics": [
    "order.created"
  ]
}'

const res = await fetch('https://api.storelyne.com/admin/2026-11/webhooks', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "url": "https://example.com",
    "topics": [
      "order.created"
    ]
  }),
});
const data = await res.json();

Response 201

{
  "webhook": {
    "id": "whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
    "app_id": "app_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
    "url": "https://example.com",
    "topics": [
      "order.created"
    ],
    "api_version": "string",
    "status": "active",
    "paused_reason": "string",
    "delivery_rate": 1,
    "created_at": "2026-11-04T10:00:00.000Z"
  },
  "secret": "string"
}

Change the URL or topics, or pause and resume

PATCH/admin/2026-11/webhooks/{id}

scope write_webhooks

Path parameters

idID (whs_...)required

Headers

X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Request body

urlstring
Up to 500 characters
topicsarray of enum
One of order.created order.paid order.cancelled order.fulfilled order.refunded refund.processed refund.failed product.created product.updated product.deleted inventory.low inventory.out_of_stock customer.created customer.updated checkout.completed
statusenum
One of active paused

Response 200

idID (whs_...)required
app_idID (app_...)required
urlstringrequired
topicsarray of enumrequired
One of order.created order.paid order.cancelled order.fulfilled order.refunded refund.processed refund.failed product.created product.updated product.deleted inventory.low inventory.out_of_stock customer.created customer.updated checkout.completed
api_versionstringrequired
statusenumrequired
One of active paused
paused_reasonstring or nullrequired
delivery_ratenumber or nullrequired
Share of deliveries in the last 7 days that succeeded.
created_attimestamprequired

Errors

400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X PATCH https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R \
  -H "Authorization: Bearer pat_live_..." \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com",
  "topics": [
    "order.created"
  ],
  "status": "active"
}'

const res = await fetch('https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R', {
  method: 'PATCH',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "url": "https://example.com",
    "topics": [
      "order.created"
    ],
    "status": "active"
  }),
});
const data = await res.json();

Response 200

{
  "id": "whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
  "app_id": "app_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
  "url": "https://example.com",
  "topics": [
    "order.created"
  ],
  "api_version": "string",
  "status": "active",
  "paused_reason": "string",
  "delivery_rate": 1,
  "created_at": "2026-11-04T10:00:00.000Z"
}

Remove a subscription

DEL/admin/2026-11/webhooks/{id}

scope write_webhooks

Path parameters

idID (whs_...)required

Headers

X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Response 204

No body.

Errors

400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X DELETE https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R \
  -H "Authorization: Bearer pat_live_..."

const res = await fetch('https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R', {
  method: 'DELETE',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
  },
});
const data = await res.json();

Response 204

No body.

Delivery log, newest first

GET/admin/2026-11/webhooks/{id}/deliveries

scope read_webhooks

Path parameters

idID (whs_...)required

Query parameters

limitinteger
Items per page, 1 to 250.
Default 50 · 1 to 250
afterstring
Cursor from a previous next_cursor.
Up to 512 characters

Response 200

dataarray of objectrequired
data[].idID (whd_...)required
data[].event_idstringrequired
data[].topicstringrequired
data[].statusenumrequired
One of pending succeeded failed
data[].attemptsintegerrequired
data[].status_codeinteger or nullrequired
data[].duration_msinteger or nullrequired
data[].response_excerptstringrequired
First 2 KB of the last response.
data[].next_attempt_attimestamp or nullrequired
data[].created_attimestamprequired
has_morebooleanrequired
next_cursorstring or nullrequired

Errors

400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R/deliveries \
  -H "Authorization: Bearer pat_live_..."

const res = await fetch('https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R/deliveries', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
  },
});
const data = await res.json();

Response 200

{
  "data": [
    {
      "id": "whd_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
      "event_id": "string",
      "topic": "string",
      "status": "pending",
      "attempts": 1,
      "status_code": 1,
      "duration_ms": 1,
      "response_excerpt": "string",
      "next_attempt_at": "2026-11-04T10:00:00.000Z",
      "created_at": "2026-11-04T10:00:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": "eyJpZCI6Ii4uLiJ9"
}

Send a delivery again now

POST/admin/2026-11/webhooks/{id}/deliveries/{delivery_id}/resend

scope write_webhooksIdempotency-Key required

Path parameters

idID (whs_...)required
delivery_idID (whd_...)required

Headers

Idempotency-Keystringrequired
Unique key for this request. Retries with the same key return the first response.
At least 1 characters · Up to 255 characters
X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Response 202

idID (whd_...)required
event_idstringrequired
topicstringrequired
statusenumrequired
One of pending succeeded failed
attemptsintegerrequired
status_codeinteger or nullrequired
duration_msinteger or nullrequired
response_excerptstringrequired
First 2 KB of the last response.
next_attempt_attimestamp or nullrequired
created_attimestamprequired

Errors

400	`idempotency_key_required`	Every POST needs an Idempotency-Key header.
400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
422	`idempotency_key_reused`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X POST https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R/deliveries/whd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/resend \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: $(uuidgen)"

const res = await fetch('https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R/deliveries/whd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/resend', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Idempotency-Key': crypto.randomUUID(),
  },
});
const data = await res.json();

Response 202

{
  "id": "whd_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
  "event_id": "string",
  "topic": "string",
  "status": "pending",
  "attempts": 1,
  "status_code": 1,
  "duration_ms": 1,
  "response_excerpt": "string",
  "next_attempt_at": "2026-11-04T10:00:00.000Z",
  "created_at": "2026-11-04T10:00:00.000Z"
}

Send a webhook.test event to this URL now

POST/admin/2026-11/webhooks/{id}/test

scope write_webhooksIdempotency-Key required

Path parameters

idID (whs_...)required

Headers

Idempotency-Keystringrequired
Unique key for this request. Retries with the same key return the first response.
At least 1 characters · Up to 255 characters
X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Response 202

idID (whd_...)required
event_idstringrequired
topicstringrequired
statusenumrequired
One of pending succeeded failed
attemptsintegerrequired
status_codeinteger or nullrequired
duration_msinteger or nullrequired
response_excerptstringrequired
First 2 KB of the last response.
next_attempt_attimestamp or nullrequired
created_attimestamprequired

Errors

400	`idempotency_key_required`	Every POST needs an Idempotency-Key header.
400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
422	`idempotency_key_reused`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X POST https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R/test \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: $(uuidgen)"

const res = await fetch('https://api.storelyne.com/admin/2026-11/webhooks/whs_01JCG8ZQ5S7T0V4X8K2M3N6P9R/test', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Idempotency-Key': crypto.randomUUID(),
  },
});
const data = await res.json();

Response 202

{
  "id": "whd_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
  "event_id": "string",
  "topic": "string",
  "status": "pending",
  "attempts": 1,
  "status_code": 1,
  "duration_ms": 1,
  "response_excerpt": "string",
  "next_attempt_at": "2026-11-04T10:00:00.000Z",
  "created_at": "2026-11-04T10:00:00.000Z"
}