Legacy This page is reference for integrations already built on the Editor API. It remains supported. New integrations use the WHCC API.
The Editor API's own webhook routes are retired. This page keeps them for integrations that still call them.
To receive order events, existing Editor API and Order Submit API integrations use the consumer callback registered through the Order Submit API. Integrations that use an API key use Event Subscriptions, documented with the WHCC API.
/webhooks/create is now /oas/webhooks/create, and /webhooks/verify is now /oas/webhooks/verify.
The old paths have been removed and now return 404 (September 2026). They spent a deprecation window registered alongside the new ones; that window is closed. If you are still calling /webhooks/create or /webhooks/verify, switch to the /oas/webhooks/* paths above — or better, to the Order Submit API, as below.
/webhooks/validate is still served and stays where it is, though it is now deprecated. It never called the Order Assembly System — it verifies a signature locally — so the rename never applied to it.
Renamed or not, these endpoints are retired. There has only ever been one consumer callback per set of credentials. The Editor API endpoints did not create a second one; they wrote to the same callback as the Order Submit API, from a different door. Registering through the Editor API therefore overwrote the callback URI you registered through Order Submit, and reset it to unverified. Webhooks stopped arriving at the original endpoint, with nothing to indicate why.
Register a consumer callback through the Order Submit API, or use an event subscription instead.
/oas/webhooks/create (deprecated — was /webhooks/create)Registers the consumer callback URI, and immediately POSTs a verification code to it. This is the route that overwrites the callback URI you registered through Order Submit. Superseded by POST /api/callback/create on the Order Submit API, which is the supported route.
It has no effect on an event subscription, which is a separate record.
If your webhooks stopped arriving after you called /oas/webhooks/create — or /webhooks/create, before it was removed — your callback URI was overwritten. Register and verify the correct URI again through the Order Submit API to restore delivery.
The two routes below do not overwrite a callback URI, so neither can cause this.
/oas/webhooks/verify (deprecated — was /webhooks/verify)Submits the verification code that /oas/webhooks/create POSTed to your callback URI. Superseded by POST /api/callback/verify on the Order Submit API.
/webhooks/validate (deprecated)Checks a WHCC-Signature header against a webhook body for you. Unchanged by the rename, and still served — but now marked deprecated in the published API reference.
You do not need it: Security and Signatures gives the verification recipe. Verifying locally costs no round trip, keeps working when this API does not, and means your webhook payloads never leave your infrastructure to be checked. The deprecation simply makes the reference agree with that advice — it does not point you at a replacement endpoint, because the replacement is the local check.
Security and Signatures — verify the WHCC-Signature on a delivery, with the right key for your path.
Event Types — the payload bodies these events arrive in.
Delivery, Retries & Idempotency — the retry schedule, the response timeout, and why your handler must deduplicate.