Skip to main content
POST
Create a webhook endpoint

Authorizations

Authorization
string
header
required

Passlet access token (plt_*) sent as Authorization: Bearer <token> or X-API-Key. Authorized scopes are listed per operation under x-required-scopes.

Body

application/json
url
string<uri>
required

Webhook delivery URL

Maximum string length: 500
events
enum<string>[]
required

Events to subscribe to

Minimum array length: 1
Available options:
pass.issued,
pass.updated,
pass.voided,
pass.failed,
pass.scanned
enabled
boolean
default:true
description
string

Optional human-readable label

Maximum string length: 255

Response

Created

id
string<uuid>
required

Webhook endpoint identifier

Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
url
string<uri>
required

Webhook delivery URL

Maximum string length: 500
events
enum<string>[]
required

Events to receive

Minimum array length: 1
Available options:
pass.issued,
pass.updated,
pass.voided,
pass.failed,
pass.scanned
enabled
boolean
required

Whether the endpoint is active

createdAt
string<date-time>
required

ISO 8601 timestamp

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
secret
string
required

HMAC secret (shown only once)

simpleToken
string
required

Simple verification token for X-Webhook-Token header (for Power Automate)

description
string | null

Optional human-readable label for the endpoint

Maximum string length: 255