---
title: "Provision the webhook endpoint"
description: "Register with the provider, or mint the shared secret."
canonical_url: "https://twominutebilling.com/help/developers/api-reference/payment-methods/provision-the-webhook-endpoint"
---
# Provision the webhook endpoint

> Register with the provider, or mint the shared secret.

<api-operation method="POST" path="/v1/businesses/{biz}/gateway_accounts/{gwa}/webhook_endpoint">
<template v-slot:docs="">

Idempotent unless `force` is passed — an already-configured account is returned unchanged (with the secret revealed) rather than re-provisioned. With `webhook_secret`, stores the gateway's secret instead (`secret_in` accounts).

## Path parameters

<table>
<thead>
  <tr>
    <th>
      Parameter
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        biz
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      Business id (biz_…)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        gwa
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      The gateway account's id (gwa_…).
    </td>
  </tr>
</tbody>
</table>

## Headers

<table>
<thead>
  <tr>
    <th>
      Parameter
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        Idempotency-Key
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      Safely retry writes — repeats return the original response. If a write FAILED after it had already taken effect, that failure is what repeats: the key is spent, and a new attempt needs a new key.
    </td>
  </tr>
</tbody>
</table>

## Body

The request body is optional.

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        force
      </code>
    </td>
    
    <td>
      <code>
        boolean
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      Re-provision / rotate even if already configured
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        webhook_secret
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      The signing secret you copied from the gateway's dashboard. Only for an account whose <code>
        mode
      </code>
      
       is <code>
        secret_in
      </code>
      
       (400 otherwise). It is kept with the account's other credentials and never returned; the response then has <code>
        configured: true
      </code>
      
      .
    </td>
  </tr>
</tbody>
</table>

## Response

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        gateway_key
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The gateway that processed the payment. One of <code>
        tmtest
      </code>
      
      , <code>
        stripe
      </code>
      
      , <code>
        paypal
      </code>
      
      , <code>
        razorpay
      </code>
      
      , <code>
        gocardless
      </code>
      
      , <code>
        braintree
      </code>
      
      , <code>
        cashfree
      </code>
      
      , <code>
        adyen
      </code>
      
      , <code>
        checkoutcom
      </code>
      
      , <code>
        authorizenet
      </code>
      
      , <code>
        square
      </code>
      
      , <code>
        mollie
      </code>
      
      , <code>
        payu
      </code>
      
      , <code>
        cybersource
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        notification_url
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The URL to register at the gateway for this account.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        secret
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      Our generated secret to paste into the gateway. Only for <code>
        paste_required
      </code>
      
      , and only with <code>
        ?reveal=true
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        webhook_id
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The gateway webhook endpoint's webhook id.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        mode
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      What the operator must do: nothing, we registered the endpoint (<code>
        self_provisioned
      </code>
      
      ); paste our secret into the gateway (<code>
        paste_required
      </code>
      
      ); paste the gateway's secret into this account as <code>
        webhook_secret
      </code>
      
       (<code>
        secret_in
      </code>
      
      ); register the URL at the gateway, as signatures use the API credentials (<code>
        url_only
      </code>
      
      ); or nothing, the gateway sends no webhooks (<code>
        not_applicable
      </code>
      
      ). One of <code>
        self_provisioned
      </code>
      
      , <code>
        paste_required
      </code>
      
      , <code>
        secret_in
      </code>
      
      , <code>
        url_only
      </code>
      
      , <code>
        not_applicable
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        configured
      </code>
    </td>
    
    <td>
      <code>
        boolean
      </code>
    </td>
    
    <td>
      We hold what we need to check signatures. For <code>
        url_only
      </code>
      
       this is always true; only the gateway knows whether the URL is registered.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        instructions
      </code>
    </td>
    
    <td>
      <code>
        array of string
      </code>
    </td>
    
    <td>
      The gateway webhook endpoint's instructions.
    </td>
  </tr>
</tbody>
</table>

## Status codes

<table>
<thead>
  <tr>
    <th>
      Status
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        200
      </code>
    </td>
    
    <td>
      Success
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        400
      </code>
    </td>
    
    <td>
      Webhook provisioning failed
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        404
      </code>
    </td>
    
    <td>
      No such gateway account
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        409
      </code>
    </td>
    
    <td>
      Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload.
    </td>
  </tr>
</tbody>
</table>
</template>

<template v-slot:request="">

```bash [Request]
curl -X POST "$TMBILLING_URL/v1/businesses/biz_XXXXXXXXXXXX01/gateway_accounts/gwa_XXXXXXXXXXXX01/webhook_endpoint" \
  -H "Authorization: Bearer $TMBILLING_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "force": false,
    "webhook_secret": "whsec_XXXXXXXXXXXX01"
  }'
```

</template>

<template v-slot:response="">
<code-group>

```json [200 OK]
{
  "gateway_key": "tmtest",
  "notification_url": "https://example.com/webhooks/billing",
  "secret": "whsec_XXXXXXXXXXXX01",
  "webhook_id": "Webhook id",
  "mode": "self_provisioned",
  "configured": false,
  "instructions": [
    "Instruction"
  ]
}
```

```json [400 Bad Request]
{
  "error": {
    "type": "invalid_request_error",
    "message": "Webhook provisioning failed"
  }
}
```

```json [404 Not Found]
{
  "error": {
    "type": "invalid_request_error",
    "message": "No such gateway account"
  }
}
```

```json [409 Conflict]
{
  "error": {
    "type": "idempotency_error",
    "message": "Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload."
  }
}
```

</code-group>
</template>
</api-operation>


## Sitemap

See the full [sitemap](https://twominutebilling.com/sitemap.md) for all pages.