API reference

Store webhooks

Manage the webhook URLs your store calls to deliver keys automatically, and read their delivery logs.

On this page

Create a webhook
List webhooks
Get a webhook
Update a webhook
Delete a webhook
Send a test event
Get delivery logs
List store providers
List actions

A store webhook is an inbound URL — https://api.santiauth.com/api/v1/webhooks/execute/<id> — that your store (SellAuth, SellSn or any custom store) calls when someone buys. SantiAuth verifies the HMAC signature, issues keys and answers with them. The Selling keys guide covers the store side; the endpoints below let you create and manage those webhooks from code, e.g. infrastructure-as-code. They need webhooks:read / webhooks:write.

Create a webhook

POST/api/v1/webhookswebhooks:write

Creates a webhook for one store product. store_provider and action_type take values from List store providers and List actions; action_config sets which keys are issued. Keep hmac_secret in sync with the secret configured in your store.

Bodyapplication/json

service_idintegerrequired> 0
Service the resource belongs to
namestringrequired1–128 chars
Webhook name for identification
store_providerstringrequired1–32 chars
Store platform identifier (e.g., shopify, woocommerce, stripe)
action_typestring
Action to perform when webhook is triggered
Default "generate_keys"
action_configobjectrequired
Configuration for the webhook action
ShowHide 11 child attributes
- provider_idinteger | null> 0
  ID of one of the webhook service's providers to issue keys from. When omitted, keys come from the service's highest-priority provider
- validity_hoursnumber | null1–8760
  Key validity duration in hours (1-8760). Null for unlimited
- unlimited_validityboolean
  Whether keys have unlimited validity
  Default false
- one_time_useboolean
  Whether keys can only be used once
  Default false
- expiry_on_first_useboolean
  Whether keys expire immediately after first use
  Default false
- is_premiumboolean
  Whether generated keys are marked as premium
  Default false
- quantity_fieldstring
  JSON path to quantity field in webhook payload
  Default "item.quantity"
- hwid_limitnumber | null1–100
  Maximum number of hardware IDs that can use each key (1-100). Null for unlimited
- order_id_fieldstring | null≤ 255 chars
  JSON path to the store's order id. When it resolves, issued keys are linked to the order so a refund delivery can revoke them
- refund_conditionsobject | null
  Conditions that mark a delivery as a refund/chargeback. A matching delivery revokes the keys of its order (needs order_id_field) instead of issuing keys
  ShowHide 2 child attributes
  - operatorstring
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
  - groupsarray of objects
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstring
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objects
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstring
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestring
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestring
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitiveboolean
    Whether string comparisons should be case-sensitive
    Default false
- refund_banboolean
  On refund, also ban the holders (Discord account and bound HWID) of the revoked keys
  Default false
hmac_secretstringrequired16–512 chars
Secret key for HMAC signature verification (at least 16 characters)
is_activeboolean
Whether the webhook is active and will process incoming requests
Default true
custom_hmac_headerstring | null≤ 128 chars
Custom HTTP header name for HMAC signature (e.g., X-Shopify-Hmac-SHA256)
custom_hmac_algorithmstring
HMAC algorithm for signature verification. Options: sha1, sha256, sha512
One ofsha1sha256sha512Default "sha256"
custom_conditionsobject | null
Optional custom conditions for filtering webhook events
ShowHide 2 child attributes
- operatorstring
  Logical operator for combining condition groups. Options: and, or
  One ofandorDefault "and"
- groupsarray of objects
  List of condition groups
  Default []
  ShowHide 2 child attributes
  - operatorstring
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
  - conditionsarray of objects
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstring
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestring
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestring
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitiveboolean
    Whether string comparisons should be case-sensitive
    Default false

Response fieldsinside data

webhookobject
ShowHide 14 child attributes
- idinteger
  Webhook unique identifier
- serviceIdinteger> 0
  Service the webhook issues keys for
- namestring
  Webhook name for identification
- storeProviderstring
  Store platform identifier
- webhookGuiduuid
  Webhook GUID for public endpoint access
- actionTypestring
  Action to perform when webhook is triggered
- actionConfigobject
  Configuration for the webhook action
  ShowHide 11 child attributes
  - provider_idinteger | nulloptional> 0
    ID of one of the webhook service's providers to issue keys from. When omitted, keys come from the service's highest-priority provider
  - validity_hoursnumber | nulloptional1–8760
    Key validity duration in hours (1-8760). Null for unlimited
  - unlimited_validitybooleanoptional
    Whether keys have unlimited validity
    Default false
  - one_time_usebooleanoptional
    Whether keys can only be used once
    Default false
  - expiry_on_first_usebooleanoptional
    Whether keys expire immediately after first use
    Default false
  - is_premiumbooleanoptional
    Whether generated keys are marked as premium
    Default false
  - quantity_fieldstringoptional
    JSON path to quantity field in webhook payload
    Default "item.quantity"
  - hwid_limitnumber | nulloptional1–100
    Maximum number of hardware IDs that can use each key (1-100). Null for unlimited
  - order_id_fieldstring | nulloptional≤ 255 chars
    JSON path to the store's order id. When it resolves, issued keys are linked to the order so a refund delivery can revoke them
  - refund_conditionsobject | nulloptional
    Conditions that mark a delivery as a refund/chargeback. A matching delivery revokes the keys of its order (needs order_id_field) instead of issuing keys
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
    groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
  - refund_banbooleanoptional
    On refund, also ban the holders (Discord account and bound HWID) of the revoked keys
    Default false
- hmacSecretstring
  Secret key for HMAC signature verification
- isActiveboolean
  Whether the webhook is active
- customHmacHeaderstring | null
  Custom HTTP header name for HMAC signature
- customHmacAlgorithmstring
  HMAC algorithm for signature verification
- customConditionsobject | null
  Custom conditions for filtering webhook events
  ShowHide 2 child attributes
  - operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
  - groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstringoptional
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestringoptional
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestringoptional
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitivebooleanoptional
    Whether string comparisons should be case-sensitive
    Default false
- createdAtdatetime
  Creation timestamp
- updatedAtdatetime
  Last update timestamp

curl -X POST "https://api.santiauth.com/api/v1/webhooks" \
  -H "x-api-key: $SANTIAUTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "service_id": 1,
  "name": "SellAuth — Lifetime Premium",
  "store_provider": "sellauth",
  "action_type": "generate_keys",
  "action_config": {
    "quantity_field": "item.quantity",
    "is_premium": true,
    "unlimited_validity": true
  },
  "hmac_secret": "whsec_abc123def456"
}'

201 Created

{
  "success": true,
  "data": {
    "webhook": {
      "id": 123,
      "serviceId": "660e8400-e29b-41d4-a716-446655440001",
      "name": "Shopify Premium Orders",
      "storeProvider": "shopify",
      "webhookGuid": "550e8400-e29b-41d4-a716-446655440000",
      "actionType": "generate_keys",
      "actionConfig": {
        "provider_id": 123,
        "validity_hours": 720,
        "unlimited_validity": false,
        "one_time_use": false,
        "expiry_on_first_use": false,
        "is_premium": true,
        "quantity_field": "item.quantity",
        "hwid_limit": 3,
        "order_id_field": "id",
        "refund_conditions": {
          "operator": "and",
          "groups": [
            {
              "operator": "and",
              "conditions": [
                {
                  "field": "item.product_id",
                  "type": "equals",
                  "value": "premium_product",
                  "case_sensitive": false
                }
              ]
            }
          ]
        },
        "refund_ban": false
      },
      "hmacSecret": "whsec_abc123def456ghi789jkl012mno345pqr678stu901vwx234yz",
      "isActive": true,
      "customHmacHeader": "X-Shopify-Hmac-SHA256",
      "customHmacAlgorithm": "sha256",
      "customConditions": {
        "operator": "and",
        "groups": [
          {
            "operator": "and",
            "conditions": [
              {
                "field": "item.product_id",
                "type": "equals",
                "value": "premium_product",
                "case_sensitive": false
              }
            ]
          }
        ]
      },
      "createdAt": "2026-04-30T15:37:22.511Z",
      "updatedAt": "2026-04-30T15:37:22.511Z"
    }
  }
}

action_config for generate_keys:

Field	Type	Notes
`quantity_field`	string, required	Payload path holding the number of keys to issue, e.g. `item.quantity`. Missing → 1; at most 100 per delivery.
`provider_id`	integer	Provider to issue keys from. Default: the service's first provider.
`validity_hours`	integer	Key lifetime in hours.
`unlimited_validity`	boolean	Lifetime keys; overrides `validity_hours`.
`is_premium`	boolean	Issue Premium keys (`SA_IsUserPremium = true`).
`one_time_use`	boolean	The key loads the script once.
`expiry_on_first_use`	boolean	Lifetime starts at first execution instead of purchase.
`hwid_limit`	integer	Devices per key (1–100).
`service_id`	integer	Service to issue keys for when `provider_id` is omitted.
`order_id_field`	string	Payload path to the order id (e.g. `data.uniqid`). Issued keys are linked to it; required for refunds.
`refund_conditions`	object	Conditions (same format as `custom_conditions`) that mark a delivery as a refund. A match revokes the order's keys instead of issuing new ones. See Refunds and chargebacks.
`refund_ban`	boolean	On refund, also ban the keys' Discord accounts and HWIDs.

List webhooks

GET/api/v1/webhookswebhooks:read

Webhooks of a service.

Query parameters

service_idintegerrequired> 0
Service the resource belongs to

Response fieldsinside data

webhooksarray of objects
ShowHide 15 child attributes
- idinteger
  Webhook unique identifier
- serviceIdinteger> 0
  Service the webhook issues keys for
- namestring
  Webhook name for identification
- storeProviderstring
  Store platform identifier
- webhookGuiduuid
  Webhook GUID for public endpoint access
- actionTypestring
  Action to perform when webhook is triggered
- actionConfigobject
  Configuration for the webhook action
  ShowHide 11 child attributes
  - provider_idinteger | nulloptional> 0
    ID of one of the webhook service's providers to issue keys from. When omitted, keys come from the service's highest-priority provider
  - validity_hoursnumber | nulloptional1–8760
    Key validity duration in hours (1-8760). Null for unlimited
  - unlimited_validitybooleanoptional
    Whether keys have unlimited validity
    Default false
  - one_time_usebooleanoptional
    Whether keys can only be used once
    Default false
  - expiry_on_first_usebooleanoptional
    Whether keys expire immediately after first use
    Default false
  - is_premiumbooleanoptional
    Whether generated keys are marked as premium
    Default false
  - quantity_fieldstringoptional
    JSON path to quantity field in webhook payload
    Default "item.quantity"
  - hwid_limitnumber | nulloptional1–100
    Maximum number of hardware IDs that can use each key (1-100). Null for unlimited
  - order_id_fieldstring | nulloptional≤ 255 chars
    JSON path to the store's order id. When it resolves, issued keys are linked to the order so a refund delivery can revoke them
  - refund_conditionsobject | nulloptional
    Conditions that mark a delivery as a refund/chargeback. A matching delivery revokes the keys of its order (needs order_id_field) instead of issuing keys
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
    groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
  - refund_banbooleanoptional
    On refund, also ban the holders (Discord account and bound HWID) of the revoked keys
    Default false
- hmacSecretstring
  Secret key for HMAC signature verification
- isActiveboolean
  Whether the webhook is active
- customHmacHeaderstring | null
  Custom HTTP header name for HMAC signature
- customHmacAlgorithmstring
  HMAC algorithm for signature verification
- customConditionsobject | null
  Custom conditions for filtering webhook events
  ShowHide 2 child attributes
  - operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
  - groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstringoptional
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestringoptional
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestringoptional
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitivebooleanoptional
    Whether string comparisons should be case-sensitive
    Default false
- createdAtdatetime
  Creation timestamp
- updatedAtdatetime
  Last update timestamp
- lastLogobject | null
  Most recent delivery log for this webhook, or null when no deliveries have been recorded yet.
  ShowHide 11 child attributes
  - idnumber
    Log entry identifier
  - webhookIdinteger> 0
    Webhook this log belongs to
  - responseStatusnumber
    HTTP-style status the pipeline produced (200, 204, 400, 404, 500)
  - requestBodystring
    Raw payload that was processed
  - responseBodystring
    Body the public endpoint returned to the caller
  - errorMessagestring | null
    Error message if the delivery did not complete cleanly
  - processingTimeMsnumber
    End-to-end processing time in milliseconds
  - retryCountnumber
    Number of retry attempts that have been made
  - nextRetryAtstring | null
    ISO timestamp of the next scheduled retry, when applicable
  - statusstring
    Lifecycle state of this delivery attempt
    One ofdonepending_retryfailed
  - createdAtstring
    Creation timestamp

curl "https://api.santiauth.com/api/v1/webhooks?service_id=1" \
  -H "x-api-key: $SANTIAUTH_API_KEY"

200 OK

{
  "success": true,
  "data": {
    "webhooks": [
      {
        "id": 123,
        "serviceId": "660e8400-e29b-41d4-a716-446655440001",
        "name": "Shopify Premium Orders",
        "storeProvider": "shopify",
        "webhookGuid": "550e8400-e29b-41d4-a716-446655440000",
        "actionType": "generate_keys",
        "actionConfig": {
          "provider_id": 123,
          "validity_hours": 720,
          "unlimited_validity": false,
          "one_time_use": false,
          "expiry_on_first_use": false,
          "is_premium": true,
          "quantity_field": "item.quantity",
          "hwid_limit": 3,
          "order_id_field": "id",
          "refund_conditions": {
            "operator": "and",
            "groups": [
              {
                "operator": "and",
                "conditions": [
                  {
                    "field": "item.product_id",
                    "type": "equals",
                    "value": "premium_product",
                    "case_sensitive": false
                  }
                ]
              }
            ]
          },
          "refund_ban": false
        },
        "hmacSecret": "whsec_abc123def456ghi789jkl012mno345pqr678stu901vwx234yz",
        "isActive": true,
        "customHmacHeader": "X-Shopify-Hmac-SHA256",
        "customHmacAlgorithm": "sha256",
        "customConditions": {
          "operator": "and",
          "groups": [
            {
              "operator": "and",
              "conditions": [
                {
                  "field": "item.product_id",
                  "type": "equals",
                  "value": "premium_product",
                  "case_sensitive": false
                }
              ]
            }
          ]
        },
        "createdAt": "2026-04-30T15:37:22.511Z",
        "updatedAt": "2026-04-30T15:37:22.511Z",
        "lastLog": {
          "id": 101,
          "webhookId": 123,
          "responseStatus": 200,
          "requestBody": "{\"item\":{\"product_id\":\"premium_product\",\"quantity\":2}}",
          "responseBody": "{\"success\":true}",
          "errorMessage": null,
          "processingTimeMs": 184,
          "retryCount": 0,
          "nextRetryAt": null,
          "status": "done",
          "createdAt": "2026-04-30T15:40:00.000Z"
        }
      }
    ]
  }
}

Get a webhook

GET/api/v1/webhooks/{id}webhooks:read

Path parameters

idintegerrequired> 0
Webhook ID

Response fieldsinside data

webhookobject
ShowHide 14 child attributes
- idinteger
  Webhook unique identifier
- serviceIdinteger> 0
  Service the webhook issues keys for
- namestring
  Webhook name for identification
- storeProviderstring
  Store platform identifier
- webhookGuiduuid
  Webhook GUID for public endpoint access
- actionTypestring
  Action to perform when webhook is triggered
- actionConfigobject
  Configuration for the webhook action
  ShowHide 11 child attributes
  - provider_idinteger | nulloptional> 0
    ID of one of the webhook service's providers to issue keys from. When omitted, keys come from the service's highest-priority provider
  - validity_hoursnumber | nulloptional1–8760
    Key validity duration in hours (1-8760). Null for unlimited
  - unlimited_validitybooleanoptional
    Whether keys have unlimited validity
    Default false
  - one_time_usebooleanoptional
    Whether keys can only be used once
    Default false
  - expiry_on_first_usebooleanoptional
    Whether keys expire immediately after first use
    Default false
  - is_premiumbooleanoptional
    Whether generated keys are marked as premium
    Default false
  - quantity_fieldstringoptional
    JSON path to quantity field in webhook payload
    Default "item.quantity"
  - hwid_limitnumber | nulloptional1–100
    Maximum number of hardware IDs that can use each key (1-100). Null for unlimited
  - order_id_fieldstring | nulloptional≤ 255 chars
    JSON path to the store's order id. When it resolves, issued keys are linked to the order so a refund delivery can revoke them
  - refund_conditionsobject | nulloptional
    Conditions that mark a delivery as a refund/chargeback. A matching delivery revokes the keys of its order (needs order_id_field) instead of issuing keys
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
    groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
  - refund_banbooleanoptional
    On refund, also ban the holders (Discord account and bound HWID) of the revoked keys
    Default false
- hmacSecretstring
  Secret key for HMAC signature verification
- isActiveboolean
  Whether the webhook is active
- customHmacHeaderstring | null
  Custom HTTP header name for HMAC signature
- customHmacAlgorithmstring
  HMAC algorithm for signature verification
- customConditionsobject | null
  Custom conditions for filtering webhook events
  ShowHide 2 child attributes
  - operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
  - groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstringoptional
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestringoptional
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestringoptional
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitivebooleanoptional
    Whether string comparisons should be case-sensitive
    Default false
- createdAtdatetime
  Creation timestamp
- updatedAtdatetime
  Last update timestamp

curl "https://api.santiauth.com/api/v1/webhooks/3f2b8c1e-4d5a-4e6f-9a7b-8c9d0e1f2a3b" \
  -H "x-api-key: $SANTIAUTH_API_KEY"

200 OK

{
  "success": true,
  "data": {
    "webhook": {
      "id": 123,
      "serviceId": "660e8400-e29b-41d4-a716-446655440001",
      "name": "Shopify Premium Orders",
      "storeProvider": "shopify",
      "webhookGuid": "550e8400-e29b-41d4-a716-446655440000",
      "actionType": "generate_keys",
      "actionConfig": {
        "provider_id": 123,
        "validity_hours": 720,
        "unlimited_validity": false,
        "one_time_use": false,
        "expiry_on_first_use": false,
        "is_premium": true,
        "quantity_field": "item.quantity",
        "hwid_limit": 3,
        "order_id_field": "id",
        "refund_conditions": {
          "operator": "and",
          "groups": [
            {
              "operator": "and",
              "conditions": [
                {
                  "field": "item.product_id",
                  "type": "equals",
                  "value": "premium_product",
                  "case_sensitive": false
                }
              ]
            }
          ]
        },
        "refund_ban": false
      },
      "hmacSecret": "whsec_abc123def456ghi789jkl012mno345pqr678stu901vwx234yz",
      "isActive": true,
      "customHmacHeader": "X-Shopify-Hmac-SHA256",
      "customHmacAlgorithm": "sha256",
      "customConditions": {
        "operator": "and",
        "groups": [
          {
            "operator": "and",
            "conditions": [
              {
                "field": "item.product_id",
                "type": "equals",
                "value": "premium_product",
                "case_sensitive": false
              }
            ]
          }
        ]
      },
      "createdAt": "2026-04-30T15:37:22.511Z",
      "updatedAt": "2026-04-30T15:37:22.511Z"
    }
  }
}

Update a webhook

PUT/api/v1/webhooks/{id}webhooks:write

Change the name, signature settings or action_config — for example to switch a product from Standard to Premium keys. Set is_active to false to stop delivering without deleting the URL your store uses.

Path parameters

idintegerrequired> 0
Webhook ID

Bodyapplication/json

namestringrequired1–128 chars
Webhook name for identification
store_providerstringrequired1–32 chars
Store platform identifier (e.g., shopify, woocommerce, stripe)
action_typestring
Action to perform when webhook is triggered
Default "generate_keys"
action_configobjectrequired
Configuration for the webhook action
ShowHide 11 child attributes
- provider_idinteger | null> 0
  ID of one of the webhook service's providers to issue keys from. When omitted, keys come from the service's highest-priority provider
- validity_hoursnumber | null1–8760
  Key validity duration in hours (1-8760). Null for unlimited
- unlimited_validityboolean
  Whether keys have unlimited validity
  Default false
- one_time_useboolean
  Whether keys can only be used once
  Default false
- expiry_on_first_useboolean
  Whether keys expire immediately after first use
  Default false
- is_premiumboolean
  Whether generated keys are marked as premium
  Default false
- quantity_fieldstring
  JSON path to quantity field in webhook payload
  Default "item.quantity"
- hwid_limitnumber | null1–100
  Maximum number of hardware IDs that can use each key (1-100). Null for unlimited
- order_id_fieldstring | null≤ 255 chars
  JSON path to the store's order id. When it resolves, issued keys are linked to the order so a refund delivery can revoke them
- refund_conditionsobject | null
  Conditions that mark a delivery as a refund/chargeback. A matching delivery revokes the keys of its order (needs order_id_field) instead of issuing keys
  ShowHide 2 child attributes
  - operatorstring
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
  - groupsarray of objects
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstring
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objects
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstring
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestring
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestring
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitiveboolean
    Whether string comparisons should be case-sensitive
    Default false
- refund_banboolean
  On refund, also ban the holders (Discord account and bound HWID) of the revoked keys
  Default false
hmac_secretstringrequired16–512 chars
Secret key for HMAC signature verification (at least 16 characters)
is_activeboolean
Whether the webhook is active and will process incoming requests
Default true
custom_hmac_headerstring | null≤ 128 chars
Custom HTTP header name for HMAC signature (e.g., X-Shopify-Hmac-SHA256)
custom_hmac_algorithmstring
HMAC algorithm for signature verification. Options: sha1, sha256, sha512
One ofsha1sha256sha512Default "sha256"
custom_conditionsobject | null
Optional custom conditions for filtering webhook events
ShowHide 2 child attributes
- operatorstring
  Logical operator for combining condition groups. Options: and, or
  One ofandorDefault "and"
- groupsarray of objects
  List of condition groups
  Default []
  ShowHide 2 child attributes
  - operatorstring
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
  - conditionsarray of objects
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstring
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestring
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestring
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitiveboolean
    Whether string comparisons should be case-sensitive
    Default false

Response fieldsinside data

webhookobject
ShowHide 14 child attributes
- idinteger
  Webhook unique identifier
- serviceIdinteger> 0
  Service the webhook issues keys for
- namestring
  Webhook name for identification
- storeProviderstring
  Store platform identifier
- webhookGuiduuid
  Webhook GUID for public endpoint access
- actionTypestring
  Action to perform when webhook is triggered
- actionConfigobject
  Configuration for the webhook action
  ShowHide 11 child attributes
  - provider_idinteger | nulloptional> 0
    ID of one of the webhook service's providers to issue keys from. When omitted, keys come from the service's highest-priority provider
  - validity_hoursnumber | nulloptional1–8760
    Key validity duration in hours (1-8760). Null for unlimited
  - unlimited_validitybooleanoptional
    Whether keys have unlimited validity
    Default false
  - one_time_usebooleanoptional
    Whether keys can only be used once
    Default false
  - expiry_on_first_usebooleanoptional
    Whether keys expire immediately after first use
    Default false
  - is_premiumbooleanoptional
    Whether generated keys are marked as premium
    Default false
  - quantity_fieldstringoptional
    JSON path to quantity field in webhook payload
    Default "item.quantity"
  - hwid_limitnumber | nulloptional1–100
    Maximum number of hardware IDs that can use each key (1-100). Null for unlimited
  - order_id_fieldstring | nulloptional≤ 255 chars
    JSON path to the store's order id. When it resolves, issued keys are linked to the order so a refund delivery can revoke them
  - refund_conditionsobject | nulloptional
    Conditions that mark a delivery as a refund/chargeback. A matching delivery revokes the keys of its order (needs order_id_field) instead of issuing keys
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
    groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
  - refund_banbooleanoptional
    On refund, also ban the holders (Discord account and bound HWID) of the revoked keys
    Default false
- hmacSecretstring
  Secret key for HMAC signature verification
- isActiveboolean
  Whether the webhook is active
- customHmacHeaderstring | null
  Custom HTTP header name for HMAC signature
- customHmacAlgorithmstring
  HMAC algorithm for signature verification
- customConditionsobject | null
  Custom conditions for filtering webhook events
  ShowHide 2 child attributes
  - operatorstringoptional
    Logical operator for combining condition groups. Options: and, or
    One ofandorDefault "and"
  - groupsarray of objectsoptional
    List of condition groups
    Default []
    ShowHide 2 child attributes
    operatorstringoptional
    Logical operator for combining conditions. Options: and, or
    One ofandorDefault "and"
    conditionsarray of objectsoptional
    List of conditions in this group
    Default []
    ShowHide 4 child attributes
    fieldstringoptional
    JSON path to the field to evaluate in webhook payload
    Default ""
    typestringoptional
    Condition type. Options: contains, equals, regex, exists, greater_than, less_than
    One ofcontainsequalsregexexistsgreater_thanless_thanDefault "contains"
    valuestringoptional
    Value to compare against (not used for 'exists' type)
    Default ""
    case_sensitivebooleanoptional
    Whether string comparisons should be case-sensitive
    Default false
- createdAtdatetime
  Creation timestamp
- updatedAtdatetime
  Last update timestamp

curl -X PUT "https://api.santiauth.com/api/v1/webhooks/3f2b8c1e-4d5a-4e6f-9a7b-8c9d0e1f2a3b" \
  -H "x-api-key: $SANTIAUTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "is_active": false
}'

200 OK

{
  "success": true,
  "data": {
    "webhook": {
      "id": 123,
      "serviceId": "660e8400-e29b-41d4-a716-446655440001",
      "name": "Shopify Premium Orders",
      "storeProvider": "shopify",
      "webhookGuid": "550e8400-e29b-41d4-a716-446655440000",
      "actionType": "generate_keys",
      "actionConfig": {
        "provider_id": 123,
        "validity_hours": 720,
        "unlimited_validity": false,
        "one_time_use": false,
        "expiry_on_first_use": false,
        "is_premium": true,
        "quantity_field": "item.quantity",
        "hwid_limit": 3,
        "order_id_field": "id",
        "refund_conditions": {
          "operator": "and",
          "groups": [
            {
              "operator": "and",
              "conditions": [
                {
                  "field": "item.product_id",
                  "type": "equals",
                  "value": "premium_product",
                  "case_sensitive": false
                }
              ]
            }
          ]
        },
        "refund_ban": false
      },
      "hmacSecret": "whsec_abc123def456ghi789jkl012mno345pqr678stu901vwx234yz",
      "isActive": true,
      "customHmacHeader": "X-Shopify-Hmac-SHA256",
      "customHmacAlgorithm": "sha256",
      "customConditions": {
        "operator": "and",
        "groups": [
          {
            "operator": "and",
            "conditions": [
              {
                "field": "item.product_id",
                "type": "equals",
                "value": "premium_product",
                "case_sensitive": false
              }
            ]
          }
        ]
      },
      "createdAt": "2026-04-30T15:37:22.511Z",
      "updatedAt": "2026-04-30T15:37:22.511Z"
    }
  }
}

Delete a webhook

DELETE/api/v1/webhooks/{id}webhooks:write

Deletes the webhook. Your store gets 404 from its URL afterwards.

Path parameters

idintegerrequired> 0
Webhook ID

curl -X DELETE "https://api.santiauth.com/api/v1/webhooks/3f2b8c1e-4d5a-4e6f-9a7b-8c9d0e1f2a3b" \
  -H "x-api-key: $SANTIAUTH_API_KEY"

204 No Content

Empty body.

Send a test event

POST/api/v1/webhooks/{id}/testwebhooks:write

Runs a payload through the webhook as if your store had sent it, including key generation, and returns the result. Use it to check action_config before going live.

Path parameters

idintegerrequired> 0
Webhook ID

Bodyapplication/json

payloadmaprequired
JSON payload to send through the pipeline. The dashboard pre-fills a sensible default that hits the configured quantity_field.

Response fieldsinside data

resultobject
ShowHide 10 child attributes
- statusnumber
  Final status from the webhook execution pipeline (200, 204, 400, 404 or 500)
- reasonstring | null
  Reason / error message when status is not 200
- keysGeneratednumber
  Number of keys generated when status is 200, otherwise 0
- keysarray of strings
  Generated API keys when the action ran successfully
- responseBodystring
  Raw response body the public endpoint would have returned
- processingTimeMsnumber
  End-to-end execution time in milliseconds
- sentPayloadstring
  Stringified payload that was sent through the pipeline
- signatureHeaderstring
  Header that carried the HMAC signature in the simulated request
- signaturestring
  Hex-encoded HMAC signature computed for the test payload
- signatureAlgorithmstring
  HMAC algorithm used to compute the signature

curl -X POST "https://api.santiauth.com/api/v1/webhooks/3f2b8c1e-4d5a-4e6f-9a7b-8c9d0e1f2a3b/test" \
  -H "x-api-key: $SANTIAUTH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "payload": {
    "item": {
      "quantity": 1
    }
  }
}'

200 OK

{
  "success": true,
  "data": {
    "result": {
      "status": 200,
      "reason": null,
      "keysGenerated": 1,
      "keys": [
        "key_abc123"
      ],
      "responseBody": "key_abc123",
      "processingTimeMs": 142,
      "sentPayload": "{\"test\":true,\"item\":{\"quantity\":1}}",
      "signatureHeader": "X-Signature",
      "signature": "8b6c…",
      "signatureAlgorithm": "sha256"
    }
  }
}

Get delivery logs

GET/api/v1/webhooks/{id}/logswebhooks:read

Recent deliveries: the request body, the response and the keys that were issued. Failed deliveries are retried automatically.

Path parameters

idintegerrequired> 0
Webhook ID

Response fieldsinside data

logsarray of objects
ShowHide 11 child attributes
- idnumber
  Log entry identifier
- webhookIdinteger> 0
  Webhook this log belongs to
- responseStatusnumber
  HTTP-style status the pipeline produced (200, 204, 400, 404, 500)
- requestBodystring
  Raw payload that was processed
- responseBodystring
  Body the public endpoint returned to the caller
- errorMessagestring | null
  Error message if the delivery did not complete cleanly
- processingTimeMsnumber
  End-to-end processing time in milliseconds
- retryCountnumber
  Number of retry attempts that have been made
- nextRetryAtstring | null
  ISO timestamp of the next scheduled retry, when applicable
- statusstring
  Lifecycle state of this delivery attempt
  One ofdonepending_retryfailed
- createdAtstring
  Creation timestamp

curl "https://api.santiauth.com/api/v1/webhooks/3f2b8c1e-4d5a-4e6f-9a7b-8c9d0e1f2a3b/logs" \
  -H "x-api-key: $SANTIAUTH_API_KEY"

200 OK

{
  "success": true,
  "data": {
    "logs": [
      {
        "id": 101,
        "webhookId": 123,
        "responseStatus": 200,
        "requestBody": "{\"item\":{\"product_id\":\"premium_product\",\"quantity\":2}}",
        "responseBody": "{\"success\":true}",
        "errorMessage": null,
        "processingTimeMs": 184,
        "retryCount": 0,
        "nextRetryAt": null,
        "status": "done",
        "createdAt": "2026-04-30T15:40:00.000Z"
      }
    ]
  }
}

List store providers

GET/api/v1/webhooks/providerswebhooks:read

Stores with built-in signature handling, plus custom.

Response fieldsinside data

providersmap

curl "https://api.santiauth.com/api/v1/webhooks/providers" \
  -H "x-api-key: $SANTIAUTH_API_KEY"

200 OK

{
  "success": true,
  "data": {
    "providers": {
      "key": {
        "name": "string",
        "description": "string",
        "hmacHeader": "string",
        "hmacAlgorithm": "string"
      }
    }
  }
}

List actions

GET/api/v1/webhooks/actionswebhooks:read

What a webhook can do when called, with the action_config each action accepts.

Response fieldsinside data

actionsmap

curl "https://api.santiauth.com/api/v1/webhooks/actions" \
  -H "x-api-key: $SANTIAUTH_API_KEY"

200 OK

{
  "success": true,
  "data": {
    "actions": {
      "key": {
        "name": "string",
        "description": "string",
        "configSchema": {
          "key": null
        }
      }
    }
  }
}