Register an endpoint (starts verification challenge)

POST

/v1/webhook-endpoints

curl https://api.pacepayments.ai/v1/webhook-endpoints \
  --request POST \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://hooks.example.org/pace/v1"
}'

requests.post(
    "https://api.pacepayments.ai/v1/webhook-endpoints",
    headers={
      "Authorization": "Bearer <token>",
      "Content-Type": "application/json"
    },
    json={
      "url": "https://hooks.example.org/pace/v1"
    }
)

fetch('https://api.pacepayments.ai/v1/webhook-endpoints', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    url: 'https://hooks.example.org/pace/v1'
  })
})

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "https://api.pacepayments.ai/v1/webhook-endpoints");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
request.Content = new StringContent(
"""
{
  "url": "https://hooks.example.org/pace/v1"
}
""",
System.Text.Encoding.UTF8, "application/json");

using var response = await client.SendAsync(request);

$ch = curl_init("https://api.pacepayments.ai/v1/webhook-endpoints");

curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer <token>', 'Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
  'url' => 'https://hooks.example.org/pace/v1'
]));

curl_exec($ch);

curl_close($ch);

package main

import (
  "fmt"
  "io"
  "net/http"
  "strings"
)

func main() {
  requestUrl := "https://api.pacepayments.ai/v1/webhook-endpoints"

  payload := strings.NewReader(`{
  "url": "https://hooks.example.org/pace/v1"
}`)

  req, _ := http.NewRequest("POST", requestUrl, payload)

  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{\n  \"url\": \"https://hooks.example.org/pace/v1\"\n}");
Request request = new Request.Builder()
  .url("https://api.pacepayments.ai/v1/webhook-endpoints")
  .post(body)
  .addHeader("Authorization", "Bearer <token>")
  .addHeader("Content-Type", "application/json")
  .build();

Response response = client.newCall(request).execute();

Authorizations

pace_oauth2
config:write

Request Body^required

application/json

WebhookEndpointCreate

object

url

required

Url

HTTPS, publicly resolvable, port 443 or 8443. Checked at registration AND before every dispatch.

string

>= 12 characters <= 2048 characters

description

Any of:

string
null

string

<= 500 characters

event_types

Any of:

Array<string>
null

Array<string>

payload_mode

Payload Mode

thin = the envelope with related but WITHOUT data. The client fetches the resource over the API when it needs it.

string

default: full

Allowed values: full thin

api_version

Api Version

string

default: v1

Allowed value: v1

Responses

201

Successful Response

application/json

WebhookEndpointWithSecret

object

required

string

url

required

Url

string

description

Any of:

string
null

string

event_types

Event Types

Array<string>

payload_mode

Payload Mode

string

default: full

Allowed values: full thin

api_version

Api Version

string

default: v1

status

required

Status

string

Allowed values: pending_verification active disabled

verification

Any of:

Verification
null

Verification

object

state

required

State

string

Allowed values: pending succeeded failed expired

last_attempt_at

Any of:

string
null

string format: date-time

expires_at

Any of:

string
null

string format: date-time

failure_reason

Any of:

string
null

string

health

EndpointHealth

object

consecutive_failures

Consecutive Failures

integer

last_success_at

Any of:

string
null

string format: date-time

last_failure_at

Any of:

string
null

string format: date-time

created_at

required

Created At

string format: date-time

secret

required

Secret

SHOWN ONCE. At creation and on every rotation - never retrievable afterwards. Store it now.

string

Example

{
  "payload_mode": "full",
  "api_version": "v1",
  "status": "pending_verification",
  "verification": {
    "state": "pending"
  },
  "health": {
    "consecutive_failures": 0
  },
  "secret": "whsec_9f2c4b7e1dREDACTED"
}

401

No valid access token. Client action: request a new token from the token endpoint and retry once. Repeated 401 with a fresh token means the client registration is disabled - contact Pace, do not retry in a loop.

application/problem+json

Problem

object

type

required

Type

string

title

required

Title

string

status

required

Status

integer

code

required

Code

string

detail

Any of:

string
null

string

instance

Any of:

string
null

string

trace_id

Any of:

string
null

string

errors

Any of:

Array<object>
null

Array<object>

FieldError

object

pointer

required

Pointer

RFC 6901 pointer to the offending field in the request body. Errors outside the body carry their source as the first segment (e.g. /query/limit).

string

code

required

Code

Stable field error code (open registry).

string

message

Any of:

string
null

string

Example^generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "code": "example",
  "detail": "example",
  "instance": "example",
  "trace_id": "example",
  "errors": [
    {
      "pointer": "example",
      "code": "example",
      "message": "example"
    }
  ]
}

403

Authenticated but not permitted. insufficient_scope names the missing scope in detail; feature_not_enabled means the tenant lacks the feature; ip_not_allowlisted means the source IP is not on the client registration’s allowlist; simulate_not_allowed means a sandbox-only simulate block was sent to the live host. None of these are retryable.

application/problem+json

Problem

object

type

required

Type

string

title

required

Title

string

status

required

Status

integer

code

required

Code

string

detail

Any of:

string
null

string

instance

Any of:

string
null

string

trace_id

Any of:

string
null

string

errors

Any of:

Array<object>
null

Array<object>

FieldError

object

pointer

required

Pointer

RFC 6901 pointer to the offending field in the request body. Errors outside the body carry their source as the first segment (e.g. /query/limit).

string

code

required

Code

Stable field error code (open registry).

string

message

Any of:

string
null

string

Example^generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "code": "example",
  "detail": "example",
  "instance": "example",
  "trace_id": "example",
  "errors": [
    {
      "pointer": "example",
      "code": "example",
      "message": "example"
    }
  ]
}

422

Validation Error

application/json

HTTPValidationError

object

detail

Detail

Array<object>

ValidationError

object

loc

required

Location

Array

msg

required

Message

string

type

required

Error Type

string

input

Input

ctx

Context

object

Example^generated

{
  "detail": [
    {
      "loc": [
        "example"
      ],
      "msg": "example",
      "type": "example",
      "input": "example",
      "ctx": {}
    }
  ]
}

429

HTTP rate limit (rate_limited) or execution capacity refusal (quota_exceeded, backlog_full) - two distinct layers. Wait for Retry-After, then retry the identical request with the same Idempotency-Key. backlog_full will not clear in seconds; back off to minutes.

application/problem+json

Problem

object

type

required

Type

string

title

required

Title

string

status

required

Status

integer

code

required

Code

string

detail

Any of:

string
null

string

instance

Any of:

string
null

string

trace_id

Any of:

string
null

string

errors

Any of:

Array<object>
null

Array<object>

FieldError

object

pointer

required

Pointer

RFC 6901 pointer to the offending field in the request body. Errors outside the body carry their source as the first segment (e.g. /query/limit).

string

code

required

Code

Stable field error code (open registry).

string

message

Any of:

string
null

string

Example^generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "code": "example",
  "detail": "example",
  "instance": "example",
  "trace_id": "example",
  "errors": [
    {
      "pointer": "example",
      "code": "example",
      "message": "example"
    }
  ]
}

Headers

Retry-After

integer

Seconds until the next attempt is permitted.

RateLimit-Limit

integer

RateLimit-Remaining

integer

RateLimit-Reset

integer

default

Error (RFC 9457). Branch on code, never on title or detail.

application/problem+json

Problem

object

type

required

Type

string

title

required

Title

string

status

required

Status

integer

code

required

Code

string

detail

Any of:

string
null

string

instance

Any of:

string
null

string

trace_id

Any of:

string
null

string

errors

Any of:

Array<object>
null

Array<object>

FieldError

object

pointer

required

Pointer

RFC 6901 pointer to the offending field in the request body. Errors outside the body carry their source as the first segment (e.g. /query/limit).

string

code

required

Code

Stable field error code (open registry).

string

message

Any of:

string
null

string

Example^generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "code": "example",
  "detail": "example",
  "instance": "example",
  "trace_id": "example",
  "errors": [
    {
      "pointer": "example",
      "code": "example",
      "message": "example"
    }
  ]
}

Register an endpoint (starts verification challenge)

Authorizations

Request Bodyrequired

Responses

201

Example

401

Examplegenerated

403

Examplegenerated

422

Examplegenerated

429

Examplegenerated

Headers

default

Examplegenerated

Request Body^required

Example^generated

Example^generated

Example^generated

Example^generated

Example^generated