> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moduluslabs.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Endpoint Management

> Create and manage Payment Webhook endpoints and signing secrets

Endpoint management uses the `/v1/webhook_endpoints` API. Read operations
require `webhooks.read`; mutations and signing-secret operations require
`webhooks.write`.

| Method   | Path                                               | Purpose                                                  |
| -------- | -------------------------------------------------- | -------------------------------------------------------- |
| `POST`   | `/v1/webhook_endpoints`                            | Register an HTTPS callback URL.                          |
| `GET`    | `/v1/webhook_endpoints`                            | List accessible endpoints.                               |
| `GET`    | `/v1/webhook_endpoints/{id}`                       | Retrieve one endpoint.                                   |
| `PATCH`  | `/v1/webhook_endpoints/{id}`                       | Update its URL, events, state, description, or metadata. |
| `DELETE` | `/v1/webhook_endpoints/{id}`                       | Disable delivery while retaining the audit record.       |
| `GET`    | `/v1/webhook_endpoints/{id}/signing_secret`        | Retrieve its `whsec_` signing secret.                    |
| `POST`   | `/v1/webhook_endpoints/{id}/signing_secret/rotate` | Rotate the secret using an `Idempotency-Key`.            |

Create and update fields use `snake_case`: `url`, `enabled_events`,
`description`, `metadata`, and, for updates, `disabled`. Metadata keys retain
the casing supplied by the merchant.

## Endpoint fields

| Field            | Description                                                                                 |
| ---------------- | ------------------------------------------------------------------------------------------- |
| `id`             | Unique endpoint identifier used by retrieve, update, delete, and signing-secret operations. |
| `url`            | Public HTTPS callback URL that receives subscribed events.                                  |
| `enabled_events` | Distinct payment event types delivered to the endpoint. At least one is required.           |
| `description`    | Optional merchant-defined label, up to 255 characters.                                      |
| `status`         | `ENABLED` while delivery is active or `DISABLED` while paused.                              |
| `metadata`       | Merchant-owned endpoint configuration metadata. It is separate from payment-event metadata. |
| `created_at`     | UTC RFC 3339 timestamp when the endpoint was created.                                       |
| `updated_at`     | UTC RFC 3339 timestamp when the endpoint was last updated.                                  |

On update, omit a field to keep its current value. Set `disabled` to `true` to
pause delivery or `false` to resume it. For `description` and `metadata`, an
omitted or `null` value leaves the current value unchanged.

List responses use cursor pagination:

```json theme={null}
{
  "data": [],
  "pagination": {
    "page_size": 20,
    "has_more": false,
    "next_cursor": null
  }
}
```

<Warning>
  Rotating a signing secret changes merchant credentials. Send a unique
  `Idempotency-Key`, store the returned secret immediately, and update your
  verifier promptly. Do not assume an undocumented overlap period.
</Warning>

See the [Payment Webhooks API reference](/api-reference/payment-webhooks/create-endpoint)
for complete request and response schemas.