# Setting Up a Webhook

Source: https://docs.astalty.com.au/developers/webhooks/setting-up-a-webhook

> Create and manage webhooks from the API Dashboard, and review delivery logs.

> **This Feature is in Beta**
>
> Webhooks must be enabled for your account. Request access or send feedback through the support button or [Astalty Support](mailto:support@astalty.com.au).

## Before you start

Prepare a publicly reachable HTTPS URL that accepts JSON `POST` requests. The endpoint must [verify Astalty signatures](https://docs.astalty.com.au/developers/webhooks/receiving-and-verifying-webhooks#verifying-the-signature), return a `2xx` response within 15 seconds and handle repeat deliveries safely.

The Account Owner can manage webhooks. An Admin also needs **Can manage API keys and webhooks**. See [Grant API Key and Webhook Access](https://docs.astalty.com.au/guide/roles-and-permissions#granting-api-key-and-webhook-access).

## Open the Webhooks area

1. Open [Settings](https://app.astalty.com.au/settings).
2. Select [API Dashboard](https://app.astalty.com.au/api/dashboard).
3. Select [Webhooks](https://app.astalty.com.au/api/webhooks).

## Create a webhook

1. Select **Create Webhook**.
2. Enter a **Description** that identifies the receiving system or purpose.
3. Enter the public HTTPS endpoint in **URL**.
4. Leave **Enabled** selected to receive events after creation. Clear it if the endpoint is not ready.
5. Under **Event Types**, select at least one [supported event](https://docs.astalty.com.au/developers/webhooks/supported-webhook-events). To fetch the event types from the API instead, see [Listing webhook events via the API](https://docs.astalty.com.au/developers/webhooks/listing-webhook-events-via-the-api).
6. Select **Create**.

## Copy your signing secret

After creation, Astalty opens the webhook detail page and shows its **Signing Secret**. Store this secret in the receiving system's secrets manager and use it to [verify each delivery](https://docs.astalty.com.au/developers/webhooks/receiving-and-verifying-webhooks#verifying-the-signature).

The Signing Secret cannot be changed. If it is exposed, archive the webhook and create a replacement with a new secret.

## Manage an existing webhook

Select a row in the Webhooks table to open its detail page. From there you can:

- Select **Edit** to change the Description, URL, Enabled state or Event Types.
- Clear **Enabled** to pause new deliveries while keeping the configuration.
- Select **Actions > Archive** to stop using the webhook and remove it from the active list.
- Use the **Status** filter on the Webhooks page to find an archived webhook, then open it and select **Actions > Unarchive** to restore it.

Disabling or archiving a webhook stops new events being queued for it. Deliveries already queued, including retries, can still be sent. Changing the **URL** also changes the destination for those pending deliveries, so make sure the new endpoint is ready before saving.

## Review delivery logs

The **Deliveries** section lists each event Astalty has sent to the webhook. Select a delivery to inspect:

- its event type, delivery ID, URL, status and payload
- the creation time, last attempt and next scheduled retry
- each attempt's status, response time, failure reason, headers and response body when available

The **Retry** action is available after a delivery is **Failed** or **Delivered**. Retrying a delivered item sends it again, so make sure the receiving system can handle the same delivery ID more than once. See [Webhook Retries and Delivery](https://docs.astalty.com.au/developers/webhooks/receiving-and-verifying-webhooks#retries-and-delivery) for the automatic schedule.