The webhook endpoint

The fields of a webhook endpoint, as every endpoint operation returns it, and where its signing secret appears.

A webhook endpoint is a URL of yours that Localoy sends events to, for every partner connected to you. You manage endpoints through the API. See Webhooks.

Attributes

idstringrequired: The endpoint's ID. Deliveries to it carry it as X-Localoy-Webhook-Id.
urlstringrequired: Where Localoy sends events. https, and within the URL requirements.
descriptionstring | nullrequired: Your note about the endpoint, up to 200 characters.
environmentstringrequired: SANDBOX or PRODUCTION. The endpoint receives only this environment's events. It cannot be changed.
eventsstring[]required: The event types it receives, such as booking.created or connection.revoked. See Events.
statusstringrequired: ENABLED or DISABLED. A disabled endpoint receives nothing but tests.
disabledAtstring | nullrequired: When it was disabled.
disabledReasonstring | nullrequired: Why it was disabled — by you, or automatically after repeated failures.
secretPreviewstringrequired: The start of the signing secret, such as whsec_Xq9vT0…, to tell secrets apart. Never enough to sign with.
secretRotatedAtstring | nullrequired: When the secret was last rotated.
lastSuccessAtstring | nullrequired: When a delivery last succeeded.
lastFailureAtstring | nullrequired: When a delivery attempt last failed.
lastErrorstring | nullrequired: The error of the last failed attempt, such as Receiver returned 503.
consecutiveFailuresintegerrequired: Failed attempts in a row, retries included. At 10 the endpoint is disabled; a success or re-enabling resets it to 0.
createdAtstringrequired: When the endpoint was created, ISO 8601 UTC.
updatedAtstringrequired: When it last changed.

The signing secret#

The endpoint never carries its full secret. The secret, starting whsec_, appears only in three responses:

Call	Returns
Create an endpoint	The endpoint, plus `secret`.
Rotate the secret	The endpoint, plus the new `secret`.
Reveal the secret	`id`, `secret` and `secretRotatedAt` only.

The webhook endpoint

{
  "id": "cm8wh00k0000000000000001",
  "url": "https://hooks.example.com/localoy",
  "description": "Production receiver",
  "environment": "PRODUCTION",
  "events": [
    "booking.created",
    "booking.updated",
    "booking.cancelled",
    "connection.updated",
    "connection.revoked"
  ],
  "status": "ENABLED",
  "disabledAt": null,
  "disabledReason": null,
  "secretPreview": "whsec_Xq9vT0…",
  "secretRotatedAt": null,
  "lastSuccessAt": "2026-09-27T11:05:42.611Z",
  "lastFailureAt": null,
  "lastError": null,
  "consecutiveFailures": 0,
  "createdAt": "2026-09-27T09:30:00.000Z",
  "updatedAt": "2026-09-27T09:30:00.000Z"
}