Skip to main content
A webhook subscription tells Exo where to send notifications and which events to listen for. Each subscription targets one resource and one or more trigger events.

​
Creating a subscription via the API

Send a POST request to the webhooks endpoint: 
curl -X POST \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "url": "https://example.com/webhook-receiver",
       "resource": "order",
       "events": ["on_create", "on_update"]
     }' \
     http://your-app.test/exo-api/webhooks
The response includes the subscription details and the webhook secret: 
{
  "id": 1,
  "user_id": 1,
  "url": "https://example.com/webhook-receiver",
  "resource": "order",
  "events": ["on_create", "on_update"],
  "secret": "a1b2c3d4e5f6...",
  "is_active": true,
  "created_at": "2026-03-28T14:30:00.000000Z",
  "updated_at": "2026-03-28T14:30:00.000000Z"
}
The secret is only returned in full when you first create the subscription. Store it securely — you’ll need it to verify webhook signatures. After creation, only a masked version is shown.

​
Subscription fields

FieldRequiredDescription
urlYesThe URL that receives webhook POST requests (max 2048 characters)
resourceYesThe resource name (e.g. order, contact) — must match a registered resource
eventsYesArray of trigger events to subscribe to: on_create, on_update, on_delete
The events array must only contain triggers that the resource supports. For example, if a resource only defines ['on_create'] in its triggers() method, you can’t subscribe to on_update.

​
Listing subscriptions

List all your webhook subscriptions: 
curl -H "Authorization: Bearer YOUR_TOKEN" \
     http://your-app.test/exo-api/webhooks

​
Updating a subscription

Update the URL or events of an existing subscription: 
curl -X PUT \
     -H "Authorization: Bearer YOUR_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{"events": ["on_create", "on_update", "on_delete"]}' \
     http://your-app.test/exo-api/webhooks/1
You cannot change the resource of an existing subscription. Delete it and create a new one instead.

​
Deleting a subscription

curl -X DELETE \
     -H "Authorization: Bearer YOUR_TOKEN" \
     http://your-app.test/exo-api/webhooks/1

​
Activating and deactivating

Subscriptions have an is_active flag. When deactivated, Exo skips the subscription during webhook delivery without deleting it. You can toggle this through the Exo dashboard.

​
Using the dashboard

Exo includes a web dashboard where you can manage subscriptions without writing API calls. Access it at /exo/dashboard (or whatever prefix you’ve configured). From the dashboard you can:
  • View all your webhook subscriptions
  • Toggle subscriptions on and off
  • Update webhook URLs and events
  • Delete subscriptions
  • See your API tokens
  • Browse available resources and their triggers
The dashboard requires a separate login at /exo/login. This is independent from your main application login.