Developer / Webhooks

Signed, real-time webhooks for every event in your business.

Signed, real-time webhooks for every event in your business.

Signed, real-time webhooks for every event in your business.

HTTPS-only endpoints. HMAC-SHA256 signing with anti-replay. CloudEvents 1.0 payloads. Automatic retries with backoff. Replay any event from the last 90 days.

HTTPS-only endpoints. HMAC-SHA256 signing with anti-replay. CloudEvents 1.0 payloads. Automatic retries with backoff. Replay any event from the last 90 days.

HTTPS-only endpoints. HMAC-SHA256 signing with anti-replay. CloudEvents 1.0 payloads. Automatic retries with backoff. Replay any event from the last 90 days.

Get early access

Get early access

  • At-least-once delivery

  • Up to 6 retry attempts with exponential backoff

  • Per-endpoint delivery logs and stats

Live event coverage

Subscribe to the events you care about. Filter the rest out at the endpoint level.

Subscribe to the events you care about. Filter the rest out at the endpoint level.

Subscribe to the events you care about. Filter the rest out at the endpoint level.

Webhook subscriptions are per-endpoint and per-event-type. Subscribe to everything, or just the events your integration needs.

Webhook subscriptions are per-endpoint and per-event-type. Subscribe to everything, or just the events your integration needs.

Cart

Manage cart activity and buyer updates.

Manage cart activity and buyer updates.

cart.created

cart.created

cart.line.added

cart.line.added

cart.line.updated

cart.line.updated

cart.line.removed

cart.line.removed

cart.buyer_identity.set

cart.buyer_identity.set

cart.currency.changed

cart.currency.changed

cart.abandoned

cart.abandoned

Checkout

Track the checkout journey from start to finish.

Track the checkout journey from start to finish.

checkout.created

checkout.created

cart.cancelled

cart.cancelled

cart.expired

cart.expired

Orders

Monitor order creation, completion, and failures.

Monitor order creation, completion, and failures.

order.created

order.created

order.completed

order.completed

order.failed

order.failed

Payments

Track successful, failed, and refunded payments.

Track successful, failed, and refunded payments.

payment.sale.succeeded

payment.sale.succeeded

payment.sale.failed

payment.sale.failed

payment.refund.created

payment.refund.created

payment.refund.reversed

payment.refund.reversed

Disputes & Chargebacks

Stay on top of payment disputes and chargebacks.

payment.dispute.opened

payment.dispute.opened

payment.dispute.updated

payment.dispute.updated

payment.chargeback.received

payment.chargeback.received

cart.line.removed

cart.line.removed

cart.buyer_identity.set

cart.buyer_identity.set

cart.currency.changed

cart.currency.changed

cart.abandoned

cart.abandoned

Payouts

Track payout transfers and their status.

payout.transfer.initiated

payout.transfer.initiated

payout.transfer.completed

payout.transfer.completed

Webhook Lifecycle

Manage and monitor your webhook endpoints.

webhook.endpoint.auto_disabled

webhook.endpoint.auto_disabled

webhook.endpoint.created

webhook.endpoint.created

webhook.endpoint.updated

webhook.endpoint.updated

CloudEvents 1.0

Predictable, versioned, standards-based payloads.

Predictable, versioned, standards-based payloads.

Every webhook payload follows the CloudEvents 1.0 JSON specification. Standard envelope, standard headers, standard semantics. Parse once, route everywhere.

Every webhook payload follows the CloudEvents 1.0 JSON specification. Standard envelope, standard headers, standard semantics. Parse once, route everywhere.

Book a free Demo Call

Events are at-least-once delivered and not globally ordered. Dedupe on the source + id combination if you build idempotency at your endpoint. The same event ID will never represent two different events.

specversion

Always "1.0". We follow CloudEvents semantics across the platform.

type

The event type identifier (e.g. cope.order.completed).

source

The originating service. Combine with id for idempotency.

id

Unique event ID, stable across retries. Use it to dedupe.

time

RFC 3339 timestamp of when the event was emitted.

subject

The primary resource ID this event refers to.

data

The event-specific payload. Schema documented per event type.

Security model

HMAC-SHA256 signatures with anti-replay. Stripe-style signing developers already know.

HMAC-SHA256 signatures with anti-replay. Stripe-style signing developers already know.

Every payload arrives with a Cope-Signature header containing a timestamp and an HMAC-SHA256 signature computed against {timestamp}.{rawBody}. Reject any request with a timestamp older than five minutes.

Every payload arrives with a Cope-Signature header containing a timestamp and an HMAC-SHA256 signature computed against {timestamp}.{rawBody}. Reject any request with a timestamp older than five minutes.

Every payload arrives with a Cope-Signature header containing a timestamp and an HMAC-SHA256 signature computed against {timestamp}.{rawBody}. Reject any request with a timestamp older than five minutes.

Cope-Signature: t=<unix_timestamp>,v1=<hex_hmac_sha256>

Cope-Signature: t=<unix_timestamp>,v1=<hex_hmac_sha256>

Dashboard
Phone

Returned once

Your signing secret is shown at endpoint creation. Store it in your secret manager immediately.

Returned once

Your signing secret is shown at endpoint creation. Store it in your secret manager immediately.

Per-endpoint

Each endpoint has its own secret. Compromise of one endpoint does not affect others.

Per-endpoint

Each endpoint has its own secret. Compromise of one endpoint does not affect others.

Email confirmation

A confirmation email is sent to the endpoint owner on creation.

Email confirmation

A confirmation email is sent to the endpoint owner on creation.

Delivery guarantees

Automatic retries, predictable backoff, honest constraints.

Automatic retries, predictable backoff, honest constraints.

At-least-once delivery with exponential backoff. We retry transient failures, skip retries on 4xx responses, and auto-disable endpoints that fail consistently.

At-least-once delivery with exponential backoff. We retry transient failures, skip retries on 4xx responses, and auto-disable endpoints that fail consistently.

At-least-once delivery with exponential backoff. We retry transient failures, skip retries on 4xx responses, and auto-disable endpoints that fail consistently.

Dashboard

5xx · Timeout

Retry on the schedule

The same event may be delivered more than once on a retry. Idempotency at your endpoint is your responsibility - dedupe on source + id.

4xx

Non-retriable

4xx responses are treated as a definitive "do not want this event." We log them and move on. No retry.

Persistent failure

Auto-disable

Consistently failing endpoints get disabled automatically. We send a webhook.endpoint.auto_disabled event and an email to the owner.

Guarantee i.

At-least-once delivery.

The same event may be delivered more than once on a retry. Idempotency at your endpoint is your responsibility - dedupe on source + id.

Guarantee ii.

No global ordering.

Events for the same subject may arrive out of order. Your endpoint should not assume sequence. Use the event time field if ordering matters to your handler.

Operating webhooks in production

Build, test, replay, monitor. All from the dashboard or the management API.

Everyone gets walked
through, start to finish.

Build, test, replay, monitor. All from the dashboard or the management API.

Every endpoint comes with a delivery log, per-endpoint stats, a synthetic test event, single and bulk replay, and a 90-day retention window.

Every endpoint comes with a delivery log, per-endpoint stats, a synthetic test event, single and bulk replay, and a 90-day retention window.

01.

Synthetic test events

Trigger a test payload from the dashboard or the management API to validate your endpoint before going live. The test event is signed exactly like a production event.

02.

Single and bulk replay

03.

Per-endpoint delivery logs

04.

Per-endpoint stats
person managing their expenses on a laptop
person making a contactless payment with a card
two ladies looking at a laptop and smiling
lady checking her phone and smiling

01.

Synthetic test events

Trigger a test payload from the dashboard or the management API to validate your endpoint before going live. The test event is signed exactly like a production event.

02.

Single and bulk replay

03.

Per-endpoint delivery logs

04.

Per-endpoint stats
person managing their expenses on a laptop
person making a contactless payment with a card
two ladies looking at a laptop and smiling
lady checking her phone and smiling

Current and upcoming

Live capabilities. And what is coming next.

Live capabilities.
And what is coming next.

HTTPS-only endpoints with HMAC-SHA256 signing and anti-replay.

Live

CloudEvents 1.0 JSON payloads across all event types.

Live

At-least-once delivery with deterministic dedupe on source + id.

Live

Exponential backoff retries (30s, 5m, 30m, 2h, 12h, max 6).

Live

Auto-disable for persistent failers, with notification event and email.

Live

Event coverage across cart, checkout, order, payment, refund, dispute, chargeback, payout.

Live

Endpoint management API with CRUD, per-type subscription filtering, signing secret returned once.

Live

Synthetic test event triggerable per endpoint.

Live

Single and bulk event replay (last 90 days).

Live

Per-endpoint delivery logs and stats (success rate, p99 latency).

Live

Signing secret rotation with grace period. Today, rotating a secret requires creating a new endpoint. Grace-period rotation in active build.

coming soon

Per-endpoint PII redaction. Configure which fields are redacted before delivery on a per-endpoint basis.

coming soon

Published Zapier, Make, and n8n connectors. Today, integrate with any of these by handling our webhooks directly. Native published connectors with managed authentication coming next.

coming soon

Guaranteed ordering and exactly-once delivery. Not on the immediate roadmap. The standards-based at-least-once model is intentional. Idempotency lives at your endpoint.

coming soon

© 2026 Cope. All rights reserved

© 2026 Cope. All rights reserved

Operated by COPE Global LLC. Payments processed via Stripe. Tax compliance powered by Avalara.

Operated by COPE Global LLC. Payments processed via Stripe. Tax compliance powered by Avalara.

Book a Demo Call