Webhook endpoints
Subscribing with a key rather than a portal session — the door an automation platform needs when it acts on a dealer's behalf.
All three take webhooks:manage. How a delivery is signed and retried is on the guide.
GET/webhooks
scopewebhooks:manageYour endpoints, and the catalogue of events they can subscribe to.
curl https://api.zinevu.com/api/public/v1/webhooks \ -H "Authorization: Bearer $ZINEVU_API_KEY"{ "data": { "webhooks": [ { "id": 7, "url": "https://your-app.example.com/hooks/zinevu", "description": "Production", "events": ["lead.created", "offer.signed"], "secret": "whsec_…", "is_active": true, "created_at": "2026-09-02T10:41:00+00:00" } ], "events": [ { "key": "lead.created", "description": "A new lead arrived — from a form, Facebook, or created by hand." }, { "key": "offer.signed", "description": "The customer signed the offer." } ] }}POST/webhooks
scopewebhooks:manageSubscribe a URL to events. Returns the signing secret.
GET /webhooks. An unknown event is a 422.curl -X POST https://api.zinevu.com/api/public/v1/webhooks \ -H "Authorization: Bearer $ZINEVU_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "url": "https://your-app.example.com/hooks/zinevu", "events": ["lead.created", "offer.signed"], "description": "Production" }'// -> 201{ "data": { "id": 7, "secret": "whsec_…", "events": ["lead.created", "offer.signed"], "is_active": true } }A sixth is refused with 409 too_many_endpoints. If you need to fan one event out to several systems, do it on your side — a queue you own is easier to debug than five subscriptions we retry independently.
DELETE/webhooks/{id}
scopewebhooks:manageStop one.
{ "data": { "id": 7 }, "meta": { "message": "Webhook deleted" } }Deleting is never gated on the plan — you can always stop what you started, even on an account whose plan no longer includes the API.
The secret#
It comes back on creation and is readable on the list, because the endpoint that can create a subscription can already read everything it needs. Store it where you store your other secrets and verify every delivery with it; an endpoint that accepts unsigned POSTs is an endpoint anybody can post to.