Getting set up
Webhooks are off until Casap turns them on for your organization.
What Casap does
- Registers the endpoint URL you give us.
- Issues the signing secret for that endpoint.
- Enables dispute webhooks for your organization.
Each environment is set up separately, with its own endpoint and its own signing secret. An endpoint registered in sandbox does not exist in production. See Environments.
What your endpoint has to do
Accept an HTTPS POST with a JSON body.
Verify the signature before you read the body, and reject anything that fails. See Verifying a message came from us.
Store the message, then return a 2xx status. Any other status counts as a failed delivery. Do the work the message asks for afterwards, as a step you can retry on your own schedule. A notification is only ever in the message that raised it, so acknowledging before you have stored the message risks losing it.
When delivery fails
A failed delivery is retried up to 8 times over roughly 28 hours. An endpoint that fails continuously for 5 days is disabled, and Casap has to re-enable it.
Repeat deliveries of a change you have already seen are normal. See Delivery and ordering.
Before you go live
Work through the Handling checklist.