Skip to main content

Webhooks

The webhooks API allows you to create, view, update, and delete individual, or a batch, of webhooks.

Webhooks can be managed via the WooCommerce settings screen or by using the REST API endpoints. The WC_Webhook class manages all data storage and retrieval of the webhook custom post type, as well as enqueuing webhook actions and processing/delivering/logging webhooks. On woocommerce_init, active webhooks are loaded.

Each webhook has:

  • status: active (delivers payload), paused (delivery paused by admin), disabled (delivery paused by failure).
  • topic: determines which resource events the webhook is triggered for.
  • delivery URL: URL where the payload is delivered, must be HTTP or HTTPS.
  • secret: an optional secret key that is used to generate a HMAC-SHA256 hash of the request body so the receiver can verify authenticity of the webhook.
  • hooks: an array of hook names that are added and bound to the webhook for processing.

Topics

The topic is a combination resource (e.g. order) and event (e.g. created) and maps to one or more hook names (e.g. woocommerce_checkout_order_processed). Webhooks can be created using the topic name and the appropriate hooks are automatically added.

Core topics are:

  • Coupons: coupon.created, coupon.updated and coupon.deleted.
  • Customers: customer.created, customer.updated and customer.deleted.
  • Orders: order.created, order.updated and order.deleted.
  • Products: product.created, product.updated and product.deleted.

Custom topics can also be used which map to a single hook name, for example you could add a webhook with topic action.woocommerce_add_to_cart that is triggered on that event. Custom topics pass the first hook argument to the payload, so in this example the cart_item_key would be included in the payload.

Delivery/payload

Delivery is performed using wp_remote_post() (HTTP POST) and processed in the background by default using wp-cron. A few custom headers are added to the request to help the receiver process the webhook:

  • X-WC-Webhook-Topic - e.g. order.updated.
  • X-WC-Webhook-Resource - e.g. order.
  • X-WC-Webhook-Event - e.g. updated.
  • X-WC-Webhook-Signature - a base64 encoded HMAC-SHA256 hash of the payload.
  • X-WC-Webhook-ID - webhook's post ID.
  • X-WC-Webhook-Delivery-ID - delivery log ID (a comment).

The payload is JSON encoded and for API resources (coupons, customers, orders, products), the response is exactly the same as if requested via the REST API.

Logging

Requests/responses are logged as comments on the webhook custom post type. Each delivery log includes:

  • Request duration.
  • Request URL, method, headers, and body.
  • Response Code, message, headers, and body.

Only the 25 most recent delivery logs are kept in order to reduce comment table bloat.

After 5 consecutive failed deliveries (as defined by a non HTTP 2xx response code), the webhook is disabled and must be edited via the REST API to re-enable.

Delivery logs can be fetched through the REST API endpoint or in code using WC_Webhook::get_delivery_logs().

Visual interface

You can find the Webhooks interface going to "WooCommerce" > "Settings" > "API" > "Webhooks", see our Visual Webhooks docs for more details.

Webhook properties

AttributeTypeDescription
idintegerUnique identifier for the resource. READ-ONLY
namestringA friendly name for the webhook. Default is Webhook created on <date>.
statusstringWebhook status. Default is active. Options active (delivers payload), paused (does not deliver), or disabled (does not deliver due delivery failures).
topicstringWebhook topic, e.g. coupon.updated. See the complete list. REQUIRED
resourcestringWebhook resource, e.g. coupon READ-ONLY
eventstringWebhook event, e.g. updated READ-ONLY
hooksarrayWooCommerce action names associated with the webhook. READ-ONLY
delivery_urlstringThe URL where the webhook payload is delivered. REQUIRED
secretstringSecret key used to generate a hash of the delivered webhook and provided in the request headers. REQUIRED WRITE-ONLY
date_createddate-timeUTC DateTime when the webhook was created READ-ONLY
date_modifieddate-timeUTC DateTime when the webhook was last updated READ-ONLY

Webhooks delivery properties

AttributeTypeDescription
idintegerUnique identifier for the resource. READ-ONLY
durationstringThe delivery duration, in seconds. READ-ONLY
summarystringA friendly summary of the response including the HTTP response code, message, and body. READ-ONLY
request_urlstringThe URL where the webhook was delivered. READ-ONLY
request_headersobjectRequest headers. See Request Headers Attributes for more details. READ-ONLY
request_bodystringRequest body. READ-ONLY
response_codestringThe HTTP response code from the receiving server. READ-ONLY
response_messagestringThe HTTP response message from the receiving server. READ-ONLY
response_headersobjectResponse headers from the receiving server. READ-ONLY
response_bodystringThe response body from the receiving server. READ-ONLY
date_createddate-timeThe date the webhook delivery was logged, in the site's timezone. READ-ONLY

Request header properties

AttributeTypeDescription
User-AgentstringThe request user agent, default is "WooCommerce/{version} Hookshot (WordPress/{version})". READ-ONLY
Content-TypestringThe request content-type, default is "application/json". READ-ONLY
X-WC-Webhook-SourcestringThe webhook source URL. READ-ONLY
X-WC-Webhook-TopicstringThe webhook topic. READ-ONLY
X-WC-Webhook-ResourcestringThe webhook resource. READ-ONLY
X-WC-Webhook-EventstringThe webhook event. READ-ONLY
X-WC-Webhook-SignaturestringA base64 encoded HMAC-SHA256 hash of the payload. READ-ONLY
X-WC-Webhook-IDintegerThe webhook's ID. READ-ONLY
X-WC-Webhook-Delivery-IDintegerThe delivery ID. READ-ONLY

Create a webhook

This API helps you to create a new webhook.

POST /wp-json/wc/v1/webhooks
curl -X POST https://example.com/wp-json/wc/v1/webhooks \
-u consumer_key:consumer_secret \
-H "Content-Type: application/json" \
-d '{
"name": "Order updated",
"topic": "order.updated",
"delivery_url": "http://requestb.in/1g0sxmo1"
}'

Retrieve a webhook

This API lets you retrieve and view a specific webhook.

GET /wp-json/wc/v1/webhooks/<id>
curl https://example.com/wp-json/wc/v1/webhooks/142 \
-u consumer_key:consumer_secret

List all webhooks

This API helps you to view all the webhooks.

GET /wp-json/wc/v1/webhooks
curl https://example.com/wp-json/wc/v1/webhooks \
-u consumer_key:consumer_secret

Available parameters

ParameterTypeDescription
contextstringScope under which the request is made; determines fields present in response. Options: view and edit.
pageintegerCurrent page of the collection.
per_pageintegerMaximum number of items to be returned in result set.
searchstringLimit results to those matching a string.
afterstringLimit response to resources published after a given ISO8601 compliant date.
beforestringLimit response to resources published before a given ISO8601 compliant date.
dates_are_gmtbooleanInterpret after and before as UTC dates when true.
excludestringEnsure result set excludes specific ids.
includestringLimit result set to specific ids.
offsetintegerOffset the result set by a specific number of items.
orderstringOrder sort attribute ascending or descending. Default is asc. Options: asc and desc.
orderbystringSort collection by object attribute. Default is date, Options: date, id, include, title and slug.
slugstringLimit result set to posts with a specific slug.
statusstringLimit result set to webhooks assigned a specific status. Default is all. Options: all, active, paused and disabled.

Update a webhook

This API lets you make changes to a webhook.

PUT /wp-json/wc/v1/webhooks/<id>
curl -X PUT https://example.com/wp-json/wc/v1/webhooks/142 \
-u consumer_key:consumer_secret \
-H "Content-Type: application/json" \
-d '{
"status": "paused"
}'

Delete a webhook

This API helps you delete a webhook.

DELETE /wp-json/wc/v1/webhooks/<id>
curl -X DELETE https://example.com/wp-json/wc/v1/webhooks/142 \
-u consumer_key:consumer_secret

Available parameters

ParameterTypeDescription
forcebooleanWhether to permanently delete the webhook. Default is false.

Batch update webhooks

This API helps you to batch create, update and delete multiple webhooks.

note

Note: By default it's limited to up to 100 objects to be created, updated or deleted.

POST /wp-json/wc/v1/webhooks/batch
curl -X POST https://example.com/wp-json/wc/v1/webhooks/batch \
-u consumer_key:consumer_secret \
-H "Content-Type: application/json" \
-d '{
"create": [
{
"name": "Coupon created",
"topic": "coupon.created",
"delivery_url": "http://requestb.in/1g0sxmo1"
},
{
"name": "Customer deleted",
"topic": "customer.deleted",
"delivery_url": "http://requestb.in/1g0sxmo1"
}
],
"delete": [
143
]
}'

Retrieve webhook delivery

This API lets you retrieve and view a specific webhook delivery.

GET /wp-json/wc/v1/webhooks/<id>/deliveries/<delivery_id>
curl https://example.com/wp-json/wc/v1/webhooks/142/deliveries/54 \
-u consumer_key:consumer_secret
note

View the Webhooks Delivery properties for more details on this response.

List all webhook deliveries

This API helps you view all deliveries from a specific webhook.

GET /wp-json/wc/v1/webhooks/<id>/deliveries
curl https://example.com/wp-json/wc/v1/webhooks/142/deliveries \
-u consumer_key:consumer_secret