Skip to main content
POST
TypeScript

Authorizations

Authorization
string
header
required

JWT access token or API token (prefixed with zipp_)

Path Parameters

orgId
string
required

Organization ID.

Example:

"clz9k2f0a0000abcd0000zzzz"

channelId
string
required

Order channel ID.

Example:

"clz9k2f0a0001abcd1234efgh"

Response

Default Response

secret
string
required

The webhook signing secret. Returned only once — store it in your system; every push to the ingest URL must carry an HMAC-SHA256 hex signature of the raw body computed with it.

Example:

"zwhs_XeVJ1n8vJZbJ0N3mYQ2fV0dK9cA5tR7uW4pL6sH8gB0"

webhookUrl
string
required

The ingest URL your system pushes signed order events to.

Example:

"https://api.zippendo.com/webhooks/order-channels/clz9k2f0a0001abcd1234efgh"

createdAt
string<date-time>
required

When this secret was issued (ISO 8601).

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
Example:

"2026-09-02T14:30:00.000Z"