/webhooks/create is now /oas/webhooks/create, and /webhooks/verify is now /oas/webhooks/verify.
The old paths still work. They are not being switched off as part of this change. They are marked deprecated in the published API reference, and will only be removed once we can see that nobody is still calling them — not on a fixed date. If you call these routes at all, move to the /oas/webhooks/* paths when convenient.
/webhooks/validate is unchanged and stays where it is. It never called the Order Assembly System — it verifies a signature locally — so the rename does not apply to it.
Renamed or not, these endpoints are retired. Register every webhook through the Order Submit API — including if your integration uses the Editor API.
There has only ever been one webhook callback per set of credentials. The Editor API endpoints did not create a second one; they wrote to the same callback as the Order Submit API, from a different door. Registering through the Editor API therefore overwrote the callback URI you registered through Order Submit, and reset it to unverified. Webhooks stopped arriving at the original endpoint, with nothing to indicate why.
Because of that, these endpoints are retired. Use the Order Submit API for both steps:
Register and verify your callback URI.
Validate the WHCC-Signature on each request you receive.
/oas/webhooks/create (deprecated — was /webhooks/create)Registers the consumer callback URI, and immediately POSTs a verification code to it. This is the route that overwrites the callback URI you registered through Order Submit. Superseded by POST /api/callback/create on the Order Submit API, which is the supported route.
If your webhooks stopped arriving after you called /oas/webhooks/create — or its deprecated alias /webhooks/create — your callback URI was overwritten. Register and verify the correct URI again through the Order Submit API to restore delivery.
The two routes below do not overwrite a callback URI, so neither can cause this.
/oas/webhooks/verify (deprecated — was /webhooks/verify)Submits the verification code that /oas/webhooks/create POSTed to your callback URI. Superseded by POST /api/callback/verify on the Order Submit API.
/webhooks/validateChecks a WHCC-Signature header against a webhook body for you. Unchanged by the rename, and not deprecated.
You do not need it: Security and Signatures gives the verification recipe, and verifying locally avoids sending your webhook payloads back to WHCC.
Webhooks in the Order Submit API documentation — registration, event types, signatures, and delivery behaviour.