/webhooks/create is now /oas/webhooks/create, and /webhooks/verify is now /oas/webhooks/verify.
The old paths have been removed and now return 404 (September 2026). They spent a deprecation window registered alongside the new ones; that window is closed. If you are still calling /webhooks/create or /webhooks/verify, switch to the /oas/webhooks/* paths above — or better, to the Order Submit API, as below.
/webhooks/validate is still served and stays where it is, though it is now deprecated. It never called the Order Assembly System — it verifies a signature locally — so the rename never applied to it.
Renamed or not, these endpoints are retired. Register every webhook through the Order Submit API — including if your integration uses the Editor API.
There has only ever been one webhook callback per set of credentials. The Editor API endpoints did not create a second one; they wrote to the same callback as the Order Submit API, from a different door. Registering through the Editor API therefore overwrote the callback URI you registered through Order Submit, and reset it to unverified. Webhooks stopped arriving at the original endpoint, with nothing to indicate why.
Because of that, these endpoints are retired. Use the Order Submit API for both steps:
Register and verify your callback URI.
Validate the WHCC-Signature on each request you receive.
/oas/webhooks/create (deprecated — was /webhooks/create)Registers the consumer callback URI, and immediately POSTs a verification code to it. This is the route that overwrites the callback URI you registered through Order Submit. Superseded by POST /api/callback/create on the Order Submit API, which is the supported route.
If your webhooks stopped arriving after you called /oas/webhooks/create — or /webhooks/create, before it was removed — your callback URI was overwritten. Register and verify the correct URI again through the Order Submit API to restore delivery.
The two routes below do not overwrite a callback URI, so neither can cause this.
/oas/webhooks/verify (deprecated — was /webhooks/verify)Submits the verification code that /oas/webhooks/create POSTed to your callback URI. Superseded by POST /api/callback/verify on the Order Submit API.
/webhooks/validate (deprecated)Checks a WHCC-Signature header against a webhook body for you. Unchanged by the rename, and still served — but now marked deprecated in the published API reference.
You do not need it: Security and Signatures gives the verification recipe. Verifying locally costs no round trip, keeps working when this API does not, and means your webhook payloads never leave your infrastructure to be checked. The deprecation simply makes the reference agree with that advice — it does not point you at a replacement endpoint, because the replacement is the local check.
Webhooks in the Order Submit API documentation — registration, event types, signatures, and delivery behaviour.