Webhook Subscription

These endpoints will allow you to easily manage webhooks subscriptions. Our requests sent to the endpoint configured in the webhook subscription are synchronous, so we wait for a response. In the case of 4xx or 5xx response codes, we retry sending the webhook once.

Get webhook subscriptions list

get

Management If sorting is not chosen, the rows will be returned in an unspecified order. To sort a result, use an _orderBy parameter in query.

Authorizations

Bearertoken

AuthorizationstringRequired

Open Loyalty has the JWT authorization. To learn what a JSON Web Token is and how it works, check out Introduction to JSON Web Tokens https://jwt.io/introduction/

Obtain an access token

Send a request with the parameters username and password

Definition

POST /api/admin/login_check Go to definition
POST /api/{storeCode}/member/login_check Go to definition

Example

curl {HOST}/api/admin/login_check
    -H 'Content-Type: application/json;charset=UTF-8'
    -H 'Accept: application/json, text/plain, */*'
    --data-binary '{"username":"admin","password":"password"}'

Example Response

{
    "token":"eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "refresh_token":"0558f8bb29948c4e54c443f..."
}

Using JSON Web Token

Add authorization header to each request
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
You can now access any API method you want under the /api prefix.

Example

curl {HOST}/api/{storeCode}/analytics/members
    -H 'Accept: application/json'
    -H 'Content-type: application/x-www-form-urlencoded'
    -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...'

Refresh JSON Web Token

You can refresh token using refresh_token that was given during login.
There are two endpoints
To refresh admin token POST /api/token/refresh Go to definition
To refresh member token POST /api/{storeCode}/token/refresh Go to definition

Path parameters

storeCodestringRequired

Store code

Query parameters

urlstringOptional

legacybooleanOptionalDeprecated

eventNamestringOptional

createdAtstring · date-timeOptional

_pageinteger · min: 1Optional

Number of page with results, starts from 1

Default: 1Example: 1

_itemsOnPageinteger · min: 1 · max: 50Optional

Items on one page

Default: 10Example: 25

Responses

200

List of webhook subscriptions

application/json

401Error

application/json

403

Forbidden.

application/json

get/api/{storeCode}/webhook/subscription

HTTPcURLJavaScriptPython

GET /api/{storeCode}/webhook/subscription HTTP/1.1
Host: openloyalty.localhost
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "items": [
    {
      "webhookSubscriptionId": "123e4567-e89b-12d3-a456-426614174000",
      "eventName": "text",
      "url": "text",
      "createdAt": "2026-07-18T16:35:38.343Z",
      "destinationType": "text",
      "hmacEnabled": true,
      "hmacSecretKeyVersion": 1,
      "hmacSecretRotatedAt": "2026-07-18T16:35:38.343Z"
    }
  ]
}

Subscribe to a webhook

post

Management This method allows adding a new webhook subscription to the system. When hmacEnabled is set to true, the response includes a one-time plaintext HMAC secret key (whsec_ prefix). The key is never shown again — store it securely.

Authorizations

Bearertoken

AuthorizationstringRequired

Open Loyalty has the JWT authorization. To learn what a JSON Web Token is and how it works, check out Introduction to JSON Web Tokens https://jwt.io/introduction/

Obtain an access token

Send a request with the parameters username and password

Definition

POST /api/admin/login_check Go to definition
POST /api/{storeCode}/member/login_check Go to definition

Example

curl {HOST}/api/admin/login_check
    -H 'Content-Type: application/json;charset=UTF-8'
    -H 'Accept: application/json, text/plain, */*'
    --data-binary '{"username":"admin","password":"password"}'

Example Response

{
    "token":"eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "refresh_token":"0558f8bb29948c4e54c443f..."
}

Using JSON Web Token

Add authorization header to each request
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
You can now access any API method you want under the /api prefix.

Example

curl {HOST}/api/{storeCode}/analytics/members
    -H 'Accept: application/json'
    -H 'Content-type: application/x-www-form-urlencoded'
    -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...'

Refresh JSON Web Token

You can refresh token using refresh_token that was given during login.
There are two endpoints
To refresh admin token POST /api/token/refresh Go to definition
To refresh member token POST /api/{storeCode}/token/refresh Go to definition

Path parameters

storeCodestringRequired

Store code

Body

application/json

or

Responses

200

Return created webhook subscription ID. When HMAC is enabled, also returns the one-time plaintext secret key.

application/json

anyOptional

400

Bad request.

application/json

401Error

application/json

403

Forbidden.

application/json

post/api/{storeCode}/webhook/subscription

HTTPcURLJavaScriptPython

POST /api/{storeCode}/webhook/subscription HTTP/1.1
Host: openloyalty.localhost
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 157

{
  "webhookSubscription": {
    "eventName": "text",
    "destinationType": "rest",
    "url": "text",
    "hmacEnabled": false,
    "headers": [
      {
        "headerName": "text",
        "headerValue": "text"
      }
    ]
  }
}

No content

Get a webhook subscription details

get

Management

Authorizations

Bearertoken

AuthorizationstringRequired

Open Loyalty has the JWT authorization. To learn what a JSON Web Token is and how it works, check out Introduction to JSON Web Tokens https://jwt.io/introduction/

Obtain an access token

Send a request with the parameters username and password

Definition

POST /api/admin/login_check Go to definition
POST /api/{storeCode}/member/login_check Go to definition

Example

curl {HOST}/api/admin/login_check
    -H 'Content-Type: application/json;charset=UTF-8'
    -H 'Accept: application/json, text/plain, */*'
    --data-binary '{"username":"admin","password":"password"}'

Example Response

{
    "token":"eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "refresh_token":"0558f8bb29948c4e54c443f..."
}

Using JSON Web Token

Add authorization header to each request
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
You can now access any API method you want under the /api prefix.

Example

curl {HOST}/api/{storeCode}/analytics/members
    -H 'Accept: application/json'
    -H 'Content-type: application/x-www-form-urlencoded'
    -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...'

Refresh JSON Web Token

You can refresh token using refresh_token that was given during login.
There are two endpoints
To refresh admin token POST /api/token/refresh Go to definition
To refresh member token POST /api/{storeCode}/token/refresh Go to definition

Path parameters

storeCodestringRequired

Store code

webhookSubscriptionstring · uuidRequired

Webhook subscription ID

Responses

200

Webhook subscription details

application/json

webhookSubscriptionIdstring · uuidOptional

eventNamestringOptional

urlstringOptional

headerNamestringOptionalDeprecated

Use 'headers' field instead.

headerValuestringOptionalDeprecated

Use 'headers' field instead.

legacybooleanOptionalDeprecated

createdAtstring · date-timeOptional

destinationTypestringOptional

hmacEnabledbooleanOptional

hmacSecretKeyVersionintegerOptional

hmacSecretRotatedAtstring · date-timeOptional

401Error

application/json

403

Forbidden.

application/json

404

Not found.

application/json

get/api/{storeCode}/webhook/subscription/{webhookSubscription}

HTTPcURLJavaScriptPython

GET /api/{storeCode}/webhook/subscription/{webhookSubscription} HTTP/1.1
Host: openloyalty.localhost
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "webhookSubscriptionId": "123e4567-e89b-12d3-a456-426614174000",
  "eventName": "text",
  "url": "text",
  "headers": [
    {
      "headerName": "text",
      "headerValue": "text"
    }
  ],
  "createdAt": "2026-07-18T16:35:38.343Z",
  "destinationType": "text",
  "hmacEnabled": true,
  "hmacSecretKeyVersion": 1,
  "hmacSecretRotatedAt": "2026-07-18T16:35:38.343Z"
}

Update subscription to a webhook

put

Management This method allows updating an existing webhook subscription. When hmacEnabled is set to true on a subscription that does not already have HMAC, the response includes a one-time plaintext HMAC secret key (whsec_ prefix). The key is never shown again — store it securely. When hmacEnabled is omitted, the HMAC state is not changed (backward compatible).

Authorizations

Bearertoken

AuthorizationstringRequired

Open Loyalty has the JWT authorization. To learn what a JSON Web Token is and how it works, check out Introduction to JSON Web Tokens https://jwt.io/introduction/

Obtain an access token

Send a request with the parameters username and password

Definition

POST /api/admin/login_check Go to definition
POST /api/{storeCode}/member/login_check Go to definition

Example

curl {HOST}/api/admin/login_check
    -H 'Content-Type: application/json;charset=UTF-8'
    -H 'Accept: application/json, text/plain, */*'
    --data-binary '{"username":"admin","password":"password"}'

Example Response

{
    "token":"eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "refresh_token":"0558f8bb29948c4e54c443f..."
}

Using JSON Web Token

Add authorization header to each request
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
You can now access any API method you want under the /api prefix.

Example

curl {HOST}/api/{storeCode}/analytics/members
    -H 'Accept: application/json'
    -H 'Content-type: application/x-www-form-urlencoded'
    -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...'

Refresh JSON Web Token

You can refresh token using refresh_token that was given during login.
There are two endpoints
To refresh admin token POST /api/token/refresh Go to definition
To refresh member token POST /api/{storeCode}/token/refresh Go to definition

Path parameters

storeCodestringRequired

Store code

webhookSubscriptionstring · uuidRequired

Webhook Subscription ID

Body

application/json

or

Responses

200

HMAC was enabled on the subscription. Returns the one-time plaintext secret key. This key will never be shown again.

application/json

204

Success. No content.

400

Bad request.

application/json

401Error

application/json

403

Forbidden.

application/json

404

Not found.

application/json

put/api/{storeCode}/webhook/subscription/{webhookSubscription}

HTTPcURLJavaScriptPython

PUT /api/{storeCode}/webhook/subscription/{webhookSubscription} HTTP/1.1
Host: openloyalty.localhost
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 137

{
  "webhookSubscription": {
    "destinationType": "rest",
    "url": "text",
    "hmacEnabled": true,
    "headers": [
      {
        "headerName": "text",
        "headerValue": "text"
      }
    ]
  }
}

{
  "hmacSecretKey": "whsec_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
  "hmacSecretKeyWarning": "This key will only be shown once. Store it securely."
}

Delete subscription to a webhook

delete

Management

Authorizations

Bearertoken

AuthorizationstringRequired

Open Loyalty has the JWT authorization. To learn what a JSON Web Token is and how it works, check out Introduction to JSON Web Tokens https://jwt.io/introduction/

Obtain an access token

Send a request with the parameters username and password

Definition

POST /api/admin/login_check Go to definition
POST /api/{storeCode}/member/login_check Go to definition

Example

curl {HOST}/api/admin/login_check
    -H 'Content-Type: application/json;charset=UTF-8'
    -H 'Accept: application/json, text/plain, */*'
    --data-binary '{"username":"admin","password":"password"}'

Example Response

{
    "token":"eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "refresh_token":"0558f8bb29948c4e54c443f..."
}

Using JSON Web Token

Add authorization header to each request
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
You can now access any API method you want under the /api prefix.

Example

curl {HOST}/api/{storeCode}/analytics/members
    -H 'Accept: application/json'
    -H 'Content-type: application/x-www-form-urlencoded'
    -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...'

Refresh JSON Web Token

You can refresh token using refresh_token that was given during login.
There are two endpoints
To refresh admin token POST /api/token/refresh Go to definition
To refresh member token POST /api/{storeCode}/token/refresh Go to definition

Path parameters

storeCodestringRequired

Store code

webhookSubscriptionstring · uuidRequired

Webhook subscription ID

Responses

204

Success. No content.

No content

401Error

application/json

403

Forbidden.

application/json

404

Not found.

application/json

delete/api/{storeCode}/webhook/subscription/{webhookSubscription}

HTTPcURLJavaScriptPython

DELETE /api/{storeCode}/webhook/subscription/{webhookSubscription} HTTP/1.1
Host: openloyalty.localhost
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

No content

Get webhook event types

get

Management

Authorizations

Bearertoken

AuthorizationstringRequired

Open Loyalty has the JWT authorization. To learn what a JSON Web Token is and how it works, check out Introduction to JSON Web Tokens https://jwt.io/introduction/

Obtain an access token

Send a request with the parameters username and password

Definition

POST /api/admin/login_check Go to definition
POST /api/{storeCode}/member/login_check Go to definition

Example

curl {HOST}/api/admin/login_check
    -H 'Content-Type: application/json;charset=UTF-8'
    -H 'Accept: application/json, text/plain, */*'
    --data-binary '{"username":"admin","password":"password"}'

Example Response

{
    "token":"eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "refresh_token":"0558f8bb29948c4e54c443f..."
}

Using JSON Web Token

Add authorization header to each request
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
You can now access any API method you want under the /api prefix.

Example

curl {HOST}/api/{storeCode}/analytics/members
    -H 'Accept: application/json'
    -H 'Content-type: application/x-www-form-urlencoded'
    -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...'

Refresh JSON Web Token

You can refresh token using refresh_token that was given during login.
There are two endpoints
To refresh admin token POST /api/token/refresh Go to definition
To refresh member token POST /api/{storeCode}/token/refresh Go to definition

Path parameters

storeCodestringRequired

Store code

Responses

200

List of webhook events

application/json

itemsstring[]Optional

401Error

application/json

403

Forbidden.

application/json

get/api/{storeCode}/webhook/event

HTTPcURLJavaScriptPython

GET /api/{storeCode}/webhook/event HTTP/1.1
Host: openloyalty.localhost
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "items": [
    "text"
  ]
}

Rotate HMAC secret key

post

Management Rotates the HMAC secret key for a webhook subscription. Returns the new plaintext key exactly once. The old key is immediately invalidated. Rate limited to once every 5 minutes.

Authorizations

Bearertoken

AuthorizationstringRequired

Open Loyalty has the JWT authorization. To learn what a JSON Web Token is and how it works, check out Introduction to JSON Web Tokens https://jwt.io/introduction/

Obtain an access token

Send a request with the parameters username and password

Definition

POST /api/admin/login_check Go to definition
POST /api/{storeCode}/member/login_check Go to definition

Example

curl {HOST}/api/admin/login_check
    -H 'Content-Type: application/json;charset=UTF-8'
    -H 'Accept: application/json, text/plain, */*'
    --data-binary '{"username":"admin","password":"password"}'

Example Response

{
    "token":"eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "refresh_token":"0558f8bb29948c4e54c443f..."
}

Using JSON Web Token

Add authorization header to each request
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
You can now access any API method you want under the /api prefix.

Example

curl {HOST}/api/{storeCode}/analytics/members
    -H 'Accept: application/json'
    -H 'Content-type: application/x-www-form-urlencoded'
    -H 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...'

Refresh JSON Web Token

You can refresh token using refresh_token that was given during login.
There are two endpoints
To refresh admin token POST /api/token/refresh Go to definition
To refresh member token POST /api/{storeCode}/token/refresh Go to definition

Path parameters

storeCodestringRequired

Store code

webhookSubscriptionIdstring · uuidRequired

Webhook Subscription ID

Body

application/json

reasonstring · max: 255Optional

Reason for rotation (default: "Manual rotation")

Example: Quarterly key rotation per security policy

Responses

200

HMAC secret key rotated successfully. The new key is shown once.

application/json

400

HMAC signing is not enabled for this webhook subscription

application/json

401Error

application/json

403

Forbidden.

application/json

404

Not found.

application/json

429

Secret rotation is limited to once every 5 minutes

application/json

post/api/{storeCode}/webhook/subscription/{webhookSubscriptionId}/rotate-secret

HTTPcURLJavaScriptPython

POST /api/{storeCode}/webhook/subscription/{webhookSubscriptionId}/rotate-secret HTTP/1.1
Host: openloyalty.localhost
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 55

{
  "reason": "Quarterly key rotation per security policy"
}

{
  "message": "HMAC secret key rotated successfully",
  "newSecretKey": "whsec_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
  "warning": "This is the only time the secret key will be displayed. Store it securely."
}