Docs
Dashboard
DocsAPI ReferenceWebhooks

Webhooks API

Receive real-time notifications for events in your account

Endpoints
Manage webhook subscriptions
GET/webhooks
POST/webhooks
GET/webhooks/{id}
PUT/webhooks/{id}
DELETE/webhooks/{id}
POST/webhooks/{id}/test

The Webhook Object

FieldTypeDescription
idstringUnique webhook identifier
namestringDisplay name for the webhook
urlstringHTTPS endpoint to receive events
eventsarrayList of subscribed event types
activebooleanWhether webhook is enabled
secretstringSigning secret (shown once on creation)
createdAtstringISO 8601 creation timestamp
updatedAtstringISO 8601 last update timestamp

Available Event Types

order.createdNew order placed
order.updatedOrder details changed
order.shippedOrder shipped with tracking
order.deliveredOrder marked as delivered
order.cancelledOrder was cancelled
order.refundedOrder was refunded
inventory.low_stockItem below reorder point
inventory.out_of_stockItem out of stock
inventory.updatedInventory levels changed
commission.approvedCommission approved for payout
commission.paidCommission paid out
product.createdNew product added
product.updatedProduct details changed
product.discontinuedProduct marked discontinued

Create a Webhook

POST/webhooks

Create a new webhook subscription. The signing secret is only returned once during creation.

Store your secret securely

The webhook secret is only shown once when creating the webhook. Store it securely in your environment variables.

curl -X POST "https://gateway.regentherapy.com/api/v1/webhooks" \
  -H "X-API-Key: rg_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Order Notifications",
    "url": "https://your-server.com/webhooks/regen",
    "events": ["order.created", "order.shipped", "order.delivered"],
    "active": true
  }'

Webhook Payload Format

All webhook events follow a consistent format with event metadata and the associated data.

{
  "id": "evt_xyz789",
  "type": "order.shipped",
  "createdAt": "2024-01-20T15:30:00Z",
  "data": {
    "orderId": "ord_abc123",
    "orderNumber": "ORD-2024-0001",
    "status": "SHIPPED",
    "trackingNumber": "1Z999AA10123456784",
    "carrier": "UPS",
    "estimatedDelivery": "2024-01-23T00:00:00Z",
    "shippedAt": "2024-01-20T15:30:00Z"
  }
}

Signature Verification

Every webhook request includes an X-Regen-Signature header. Always verify this signature to ensure the request came from Regen Therapy.

import crypto from 'crypto';

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
  
  const trusted = Buffer.from(`sha256=${expectedSignature}`, 'utf8');
  const untrusted = Buffer.from(signature, 'utf8');
  
  return crypto.timingSafeEqual(trusted, untrusted);
}

// In your webhook handler:
app.post('/webhooks/regen', (req, res) => {
  const signature = req.headers['x-regen-signature'];
  const payload = JSON.stringify(req.body);
  
  if (!verifyWebhookSignature(payload, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process the webhook
  const event = req.body;
  console.log('Received event:', event.type);
  
  res.status(200).send('OK');
});
Best Practices
1

Respond quickly: Return a 2xx status within 5 seconds. Process events asynchronously.

2

Handle retries: We retry failed deliveries up to 5 times with exponential backoff.

3

Idempotency: Use the event id to deduplicate events.

4

Use HTTPS: Webhook URLs must use HTTPS for security.

5

Test first: Use the test endpoint to verify your integration before going live.

Commissions APIAPI Keys