Webhooks API Status
Separate provider callback endpoints from the outbound subscription API that public v1 does not include now.
Eigenn public OpenAPI v1 contains provider callback endpoints. It does not contain general outbound subscription management.
Provider Callback Endpoints
The contract includes callback operations under both /webhook and /webhooks for supported first-party connections:
- Inbox ingestion
- Polar
- WhatsApp verification and events
- Stripe
- Storecove e-invoicing
Each endpoint is a destination for its provider. They can use provider-specific verification. The normal customer API bearer scheme does not protect them.
Do not call them to publish a custom event or to register a delivery endpoint.
No Public Subscription CRUD
Public v1 does not document:
- POST /webhooks to create a subscription
- GET /webhooks to list subscriptions
PATCH /webhooks/{id}DELETE /webhooks/{id}
Public v1 also does not publish a universal outbound event catalog or a signature header. It does not publish a method to exchange a secret that signs deliveries, a delivery ID, or a retry policy.
Generated SDK Boundary
Generated SDKs include a WebhooksApi because OpenAPI tags the provider callback operations as webhooks.
That generated class is not an outbound webhook-management client. We recommend that most API consumers do not call the provider callback methods directly.
Use Marketplace Automation
For event-driven automation, connect a supported app through Apps:
- Zapier
- n8n
- Make
Each app has its own supported event set and delivery behavior. Zapier and n8n now use a shared event envelope. They also deliver each event a maximum of three times. But that is not a universal public webhook contract.
See Webhooks for the current event and receiver boundaries.
Legacy Event Names
Legacy documentation listed names such as invoice.updated, payment.succeeded, transaction.enriched, and workflow.completed as a general event catalog. Public OpenAPI v1 does not define that catalog.
Use only the event names that the selected marketplace app shows. Do not build a generic subscriber for undocumented names.
Security
Now, marketplace automation deliveries do not publish a universal Eigenn signature scheme. Until they do, apply these controls:
- Use a purpose-specific destination.
- Confirm organizationId and the event data.
- Accept only the expected events.
- Make the effects idempotent.
- Examine high-risk writes more carefully.