Skip to main content

Webhooks

The webhooks API allows you to create, view, update, and delete individual, or a batch, of webhooks.

Webhooks can be managed via the WooCommerce settings screen or by using the REST API endpoints. The WC_Webhook class manages all data storage and retrieval of the webhook custom post type, as well as enqueuing webhook actions and processing/delivering/logging webhooks. On woocommerce_init, active webhooks are loaded.

Each webhook has:

  • status: active (delivers payload), paused (delivery paused by admin), disabled (delivery paused by failure).
  • topic: determines which resource events the webhook is triggered for.
  • delivery URL: URL where the payload is delivered, must be HTTP or HTTPS.
  • secret: an optional secret key that is used to generate a HMAC-SHA256 hash of the request body so the receiver can verify authenticity of the webhook.
  • hooks: an array of hook names that are added and bound to the webhook for processing.

Topics

The topic is a combination resource (e.g. order) and event (e.g. created) and maps to one or more hook names (e.g. woocommerce_checkout_order_processed). Webhooks can be created using the topic name and the appropriate hooks are automatically added.

Core topics are:

  • Coupons: coupon.created, coupon.updated and coupon.deleted.
  • Customers: customer.created, customer.updated and customer.deleted.
  • Orders: order.created, order.updated and order.deleted.
  • Products: product.created, product.updated and product.deleted.

Custom topics can also be used which map to a single hook name, for example you could add a webhook with topic action.woocommerce_add_to_cart that is triggered on that event. Custom topics pass the first hook argument to the payload, so in this example the cart_item_key would be included in the payload.

Delivery/payload

Delivery is performed using wp_remote_post() (HTTP POST) and processed in the background by default using wp-cron. A few custom headers are added to the request to help the receiver process the webhook:

  • X-WC-Webhook-Source: http://example.com/.
  • X-WC-Webhook-Topic - e.g. order.updated.
  • X-WC-Webhook-Resource - e.g. order.
  • X-WC-Webhook-Event - e.g. updated.
  • X-WC-Webhook-Signature - a base64 encoded HMAC-SHA256 hash of the payload.
  • X-WC-Webhook-ID - webhook's post ID.
  • X-WC-Webhook-Delivery-ID - delivery log ID (a comment).

The payload is JSON encoded and for API resources (coupons, customers, orders, products), the response is exactly the same as if requested via the REST API.

Logging

Requests/responses are logged as comments on the webhook custom post type. Each delivery log includes:

  • Request duration.
  • Request URL, method, headers, and body.
  • Response Code, message, headers, and body.

Only the 25 most recent delivery logs are kept in order to reduce comment table bloat.

After 5 consecutive failed deliveries (as defined by a non HTTP 2xx response code), the webhook is disabled and must be edited via the REST API to re-enable.

Delivery logs can be fetched through the REST API endpoint or in code using WC_Webhook::get_delivery_logs().

Visual interface

You can find the Webhooks interface going to "WooCommerce" > "Settings" > "API" > "Webhooks", see our Visual Webhooks docs for more details.

Webhook properties

AttributeTypeDescription
idintegerUnique identifier for the resource. READ-ONLY
namestringA friendly name for the webhook.
statusstringWebhook status. Options: active, paused and disabled. Default is active.
topicstringWebhook topic. MANDATORY
resourcestringWebhook resource. READ-ONLY
eventstringWebhook event. READ-ONLY
hooksarrayWooCommerce action names associated with the webhook. READ-ONLY
delivery_urlstringThe URL where the webhook payload is delivered. READ-ONLY MANDATORY
secretstringSecret key used to generate a hash of the delivered webhook and provided in the request headers. This will default is a MD5 hash from the current user's ID
date_createddate-timeThe date the webhook was created, in the site's timezone. READ-ONLY
date_created_gmtdate-timeThe date the webhook was created, as GMT. READ-ONLY
date_modifieddate-timeThe date the webhook was last modified, in the site's timezone. READ-ONLY
date_modified_gmtdate-timeThe date the webhook was last modified, as GMT. READ-ONLY

Webhook delivery properties

AttributeTypeDescription
idintegerUnique identifier for the resource. READ-ONLY
durationstringThe delivery duration, in seconds. READ-ONLY
summarystringA friendly summary of the response including the HTTP response code, message, and body. READ-ONLY
request_urlstringThe URL where the webhook was delivered. READ-ONLY
request_headersarrayRequest headers. READ-ONLY
request_bodystringRequest body. READ-ONLY
response_codestringThe HTTP response code from the receiving server. READ-ONLY
response_messagestringThe HTTP response message from the receiving server. READ-ONLY
response_headersarrayArray of the response headers from the receiving server. READ-ONLY
response_bodystringThe response body from the receiving server. READ-ONLY
date_createddate-timeThe date the webhook delivery was logged, in the site's timezone. READ-ONLY
date_created_gmtdate-timeThe date the webhook delivery was logged, GMT. READ-ONLY

Request header properties

AttributeTypeDescription
User-AgentstringThe request user agent, default is "WooCommerce/{version} Hookshot (WordPress/{version})". READ-ONLY
Content-TypestringThe request content-type, default is "application/json". READ-ONLY
X-WC-Webhook-SourcestringThe webhook source. READ-ONLY
X-WC-Webhook-TopicstringThe webhook topic. READ-ONLY
X-WC-Webhook-ResourcestringThe webhook resource. READ-ONLY
X-WC-Webhook-EventstringThe webhook event. READ-ONLY
X-WC-Webhook-SignaturestringA base64 encoded HMAC-SHA256 hash of the payload. READ-ONLY
X-WC-Webhook-IDintegerThe webhook's ID. READ-ONLY
X-WC-Webhook-Delivery-IDintegerThe delivery ID. READ-ONLY

Create a webhook

This API helps you to create a new webhook.

POST /wp-json/wc/v2/webhooks
curl -X POST https://example.com/wp-json/wc/v2/webhooks \
-u consumer_key:consumer_secret \
-H "Content-Type: application/json" \
-d '{
"name": "Order updated",
"topic": "order.updated",
"delivery_url": "http://requestb.in/1g0sxmo1"
}'

Retrieve a webhook

This API lets you retrieve and view a specific webhook.

GET /wp-json/wc/v2/webhooks/<id>
curl https://example.com/wp-json/wc/v2/webhooks/142 \
-u consumer_key:consumer_secret

List all webhooks

This API helps you to view all the webhooks.

GET /wp-json/wc/v2/webhooks
curl https://example.com/wp-json/wc/v2/webhooks \
-u consumer_key:consumer_secret

Available parameters

ParameterTypeDescription
contextstringScope under which the request is made; determines fields present in response. Options: view and edit. Default is view.
pageintegerCurrent page of the collection. Default is 1.
per_pageintegerMaximum number of items to be returned in result set. Default is 10.
searchstringLimit results to those matching a string.
afterstringLimit response to resources published after a given ISO8601 compliant date.
beforestringLimit response to resources published before a given ISO8601 compliant date.
dates_are_gmtbooleanInterpret after and before as UTC dates when true.
excludearrayEnsure result set excludes specific IDs.
includearrayLimit result set to specific ids.
offsetintegerOffset the result set by a specific number of items.
orderstringOrder sort attribute ascending or descending. Options: asc and desc. Default is desc.
orderbystringSort collection by object attribute. Options: date, id, include, title and slug. Default is date.
statusstringLimit result set to webhooks assigned a specific status. Options: all, active, paused and disabled. Default is all.

Update a webhook

This API lets you make changes to a webhook.

PUT /wp-json/wc/v2/webhook/<id>
curl -X PUT https://example.com/wp-json/wc/v2/webhook/142 \
-u consumer_key:consumer_secret \
-H "Content-Type: application/json" \
-d '{
"status": "paused"
}'

Delete a webhook

This API helps you delete a webhook.

DELETE /wp-json/wc/v2/webhooks/<id>
curl -X DELETE https://example.com/wp-json/wc/v2/webhooks/142 \
-u consumer_key:consumer_secret

Available parameters

ParameterTypeDescription
forcestringUse true whether to permanently delete the webhook, Default is false.

Batch update webhooks

This API helps you to batch create, update and delete multiple webhooks.

note

Note: By default it's limited to up to 100 objects to be created, updated or deleted.

POST /wp-json/wc/v2/webhooks/batch
curl -X POST https://example.com/wp-json/wc/v2/webhooks/batch \
-u consumer_key:consumer_secret \
-H "Content-Type: application/json" \
-d '{
"create": [
{
"name": "Coupon created",
"topic": "coupon.created",
"delivery_url": "http://requestb.in/1g0sxmo1"
},
{
"name": "Customer deleted",
"topic": "customer.deleted",
"delivery_url": "http://requestb.in/1g0sxmo1"
}
],
"delete": [
143
]
}'

Retrieve webhook delivery

This API lets you retrieve and view a specific webhook delivery.

GET /wp-json/wc/v2/webhooks/<id>/deliveries/<delivery_id>
curl https://example.com/wp-json/wc/v2/webhooks/142/deliveries/54 \
-u consumer_key:consumer_secret
note

View the Webhooks Delivery properties for more details on this response.

List all webhook deliveries

This API helps you to view all deliveries from a specific webhooks.

GET /wp-json/wc/v2/webhooks/<id>/deliveries
curl https://example.com/wp-json/wc/v2/webhooks/142/deliveries \
-u consumer_key:consumer_secret