/
Dashboard

Webhooks

Configure webhook notifications for document status changes.

Manage webhook configurations via JSON:API. See the Webhooks guide for payload structure, signature verification, and retry policy.

List all webhook configurations visible to the caller in the caller's environment (own tenant + sub-tenants if caller is a PARTNER)

GET /bizzlink/webhooks
List all webhook configurations visible to the caller in the caller’s environment (own tenant + sub-tenants if caller is a PARTNER)

Responses:

StatusDescription
200OK

Response Body — JsonApiScopedListDocumentWebhookAttributes:

FieldTypeDescription
dataJsonApiScopedResourceWebhookAttributes[]
    attributesWebhookAttributesResource-specific fields.
        chainEnabledboolean
        createdAtdatetime
        enabledboolean
        environmentstring
        eventsstring[]
        secretstring
        updatedAtdatetime
        urlstring
    idstringUnique resource identifier (UUID).
    metaJsonApiMetaResource-level meta object carrying the ownership scope (tenant vs legal-entity).
        scopeJsonApiScope
            typestringScope type. 'tenant' = applies to the whole tenant. 'legal-entity' = applies only to the Peppol ID given in 'value'. 'partner' = applies to all child tenants of the calling partner tenant; 'value' must be empty.
            valuestringRequired when type='legal-entity': the Peppol ID (scheme:identifier) that owns this resource, e.g. '9938:lu28079289'. Must belong to the requesting tenant. Ignored when type='tenant'. Must be empty when type='partner'.
    typestringResource type — matches the endpoint (e.g. 'email-templates', 'notification-emails').
linksJsonApiLinks
    firststringURL of the first page.
    laststringURL of the last page.
    nextstringURL of the next page, null on last page.
    prevstringURL of the previous page, null on first page.
    selfstringURL of the current page.
metaJsonApiPaginationMeta
    pageinteger1-based index of the current page.
    sizeintegerNumber of items per page.
    totalElementsintegerTotal number of items across all pages.
    totalPagesintegerTotal number of pages.
cURL Request
curl -X GET https://gateway.vigasoft.lu/bizzlink/webhooks \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "X-Bizzlink-Signature: t=$TIMESTAMP,v1=$SIGNATURE"
Response 200 OK
{
    "data": [
    {
        "attributes": {
          "chainEnabled": false,
          "createdAt": "2026-01-01T00:00:00Z",
          "enabled": false,
          "environment": "string",
          "events": ["string"],
          "secret": "string",
          "updatedAt": "2026-01-01T00:00:00Z",
          "url": "string"
      },
        "id": "550e8400-e29b-41d4-a716-446655440000",
        "meta": {
          "scope": {
            "type": "legal-entity",
            "value": "9938:lu28079289"
        }
      },
        "type": "email-templates"
    }
    ],
    "links": {
      "first": "https://gateway.vigasoft.lu/bizzlink/documents?page%5Bnumber%5D=1&page%5Bsize%5D=20",
      "last": "https://gateway.vigasoft.lu/bizzlink/documents?page%5Bnumber%5D=7&page%5Bsize%5D=20",
      "next": "https://gateway.vigasoft.lu/bizzlink/documents?page%5Bnumber%5D=4&page%5Bsize%5D=20",
      "prev": "https://gateway.vigasoft.lu/bizzlink/documents?page%5Bnumber%5D=2&page%5Bsize%5D=20",
      "self": "https://gateway.vigasoft.lu/bizzlink/documents?page%5Bnumber%5D=3&page%5Bsize%5D=20"
  },
    "meta": {
      "page": 1,
      "size": 20,
      "totalElements": 137,
      "totalPages": 7
  }
}

Create a webhook configuration. Scope (tenant/legal-entity/partner) is set via meta.scope. PARTNER callers may target sub-tenants via tenant.value=<sub-tenant-uuid> or by referencing a sub-tenant's Peppol ID.

POST /bizzlink/webhooks
Create a webhook configuration. Scope (tenant/legal-entity/partner) is set via meta.scope. PARTNER callers may target sub-tenants via tenant.value= or by referencing a sub-tenant’s Peppol ID.

Request Body:

FieldTypeRequiredDescription
dataobjectYesResource envelope. 'attributes' holds the domain fields; 'meta.scope' declares whether the resource belongs to the whole tenant or to a specific legal entity (Peppol ID).
    attributesWebhookAttributesRequestYesThe actual resource fields.
        chainEnabledbooleanNoOnly effective for legal-entity-scoped webhooks: when true, the tenant-level webhook also fires in addition to this one (cascade). Silently forced to false for tenant- and partner-scoped webhooks. Defaults to false.
        enabledbooleanNoWhether the webhook is active. Disabled webhooks are not invoked. Defaults to true.
        eventsstring[]NoList of events to subscribe to. Defaults to all document events when omitted.
        urlstringYesPublic HTTPS endpoint that will receive POST requests with the event payload. Must not point to an internal host, IP literal, or private/loopback range.
    metaJsonApiMetaNoOptional JSON:API meta. Only used by scoped resources (e.g. email templates, notification emails) to declare their ownership scope.
        scopeJsonApiScopeYes
            typestringYesScope type. 'tenant' = applies to the whole tenant. 'legal-entity' = applies only to the Peppol ID given in 'value'. 'partner' = applies to all child tenants of the calling partner tenant; 'value' must be empty.
            valuestringNoRequired when type='legal-entity': the Peppol ID (scheme:identifier) that owns this resource, e.g. '9938:lu28079289'. Must belong to the requesting tenant. Ignored when type='tenant'. Must be empty when type='partner'.
    typestringNoMust be 'webhooks' for this endpoint.

Responses:

StatusDescription
200OK

Response Body — JsonApiScopedDocumentWebhookAttributes:

FieldTypeDescription
dataJsonApiScopedResourceWebhookAttributes
    attributesWebhookAttributesResource-specific fields.
        chainEnabledboolean
        createdAtdatetime
        enabledboolean
        environmentstring
        eventsstring[]
        secretstring
        updatedAtdatetime
        urlstring
    idstringUnique resource identifier (UUID).
    metaJsonApiMetaResource-level meta object carrying the ownership scope (tenant vs legal-entity).
        scopeJsonApiScope
            typestringScope type. 'tenant' = applies to the whole tenant. 'legal-entity' = applies only to the Peppol ID given in 'value'. 'partner' = applies to all child tenants of the calling partner tenant; 'value' must be empty.
            valuestringRequired when type='legal-entity': the Peppol ID (scheme:identifier) that owns this resource, e.g. '9938:lu28079289'. Must belong to the requesting tenant. Ignored when type='tenant'. Must be empty when type='partner'.
    typestringResource type — matches the endpoint (e.g. 'email-templates', 'notification-emails').
cURL Request
curl -X POST https://gateway.vigasoft.lu/bizzlink/webhooks \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "X-Bizzlink-Signature: t=$TIMESTAMP,v1=$SIGNATURE" \
  -H "Content-Type: application/json" \
  -d '{
      "data": {}
  }'
Response 200 OK
{
    "data": {
      "attributes": {
        "chainEnabled": false,
        "createdAt": "2026-01-01T00:00:00Z",
        "enabled": false,
        "environment": "string",
        "events": ["string"],
        "secret": "string",
        "updatedAt": "2026-01-01T00:00:00Z",
        "url": "string"
    },
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "meta": {
        "scope": {
          "type": "legal-entity",
          "value": "9938:lu28079289"
      }
    },
      "type": "email-templates"
  }
}

Delete a webhook configuration

DELETE /bizzlink/webhooks/{id}
Delete a webhook configuration

Responses:

StatusDescription
200OK
cURL Request
curl -X DELETE https://gateway.vigasoft.lu/bizzlink/webhooks/{id} \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "X-Bizzlink-Signature: t=$TIMESTAMP,v1=$SIGNATURE"

Get a specific webhook configuration (own tenant or sub-tenant if caller is PARTNER)

GET /bizzlink/webhooks/{id}
Get a specific webhook configuration (own tenant or sub-tenant if caller is PARTNER)

Responses:

StatusDescription
200OK

Response Body — JsonApiScopedDocumentWebhookAttributes:

FieldTypeDescription
dataJsonApiScopedResourceWebhookAttributes
    attributesWebhookAttributesResource-specific fields.
        chainEnabledboolean
        createdAtdatetime
        enabledboolean
        environmentstring
        eventsstring[]
        secretstring
        updatedAtdatetime
        urlstring
    idstringUnique resource identifier (UUID).
    metaJsonApiMetaResource-level meta object carrying the ownership scope (tenant vs legal-entity).
        scopeJsonApiScope
            typestringScope type. 'tenant' = applies to the whole tenant. 'legal-entity' = applies only to the Peppol ID given in 'value'. 'partner' = applies to all child tenants of the calling partner tenant; 'value' must be empty.
            valuestringRequired when type='legal-entity': the Peppol ID (scheme:identifier) that owns this resource, e.g. '9938:lu28079289'. Must belong to the requesting tenant. Ignored when type='tenant'. Must be empty when type='partner'.
    typestringResource type — matches the endpoint (e.g. 'email-templates', 'notification-emails').
cURL Request
curl -X GET https://gateway.vigasoft.lu/bizzlink/webhooks/{id} \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "X-Bizzlink-Signature: t=$TIMESTAMP,v1=$SIGNATURE"
Response 200 OK
{
    "data": {
      "attributes": {
        "chainEnabled": false,
        "createdAt": "2026-01-01T00:00:00Z",
        "enabled": false,
        "environment": "string",
        "events": ["string"],
        "secret": "string",
        "updatedAt": "2026-01-01T00:00:00Z",
        "url": "string"
    },
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "meta": {
        "scope": {
          "type": "legal-entity",
          "value": "9938:lu28079289"
      }
    },
      "type": "email-templates"
  }
}

Update a webhook configuration. Scope is immutable — only attributes can be patched.

PATCH /bizzlink/webhooks/{id}
Update a webhook configuration. Scope is immutable — only attributes can be patched.

Request Body:

FieldTypeRequiredDescription
dataobjectYes
    attributesWebhookAttributesRequestYes
        chainEnabledbooleanNoOnly effective for legal-entity-scoped webhooks: when true, the tenant-level webhook also fires in addition to this one (cascade). Silently forced to false for tenant- and partner-scoped webhooks. Defaults to false.
        enabledbooleanNoWhether the webhook is active. Disabled webhooks are not invoked. Defaults to true.
        eventsstring[]NoList of events to subscribe to. Defaults to all document events when omitted.
        urlstringYesPublic HTTPS endpoint that will receive POST requests with the event payload. Must not point to an internal host, IP literal, or private/loopback range.
    idstringNo
    metaJsonApiMetaNo
        scopeJsonApiScopeYes
            typestringYesScope type. 'tenant' = applies to the whole tenant. 'legal-entity' = applies only to the Peppol ID given in 'value'. 'partner' = applies to all child tenants of the calling partner tenant; 'value' must be empty.
            valuestringNoRequired when type='legal-entity': the Peppol ID (scheme:identifier) that owns this resource, e.g. '9938:lu28079289'. Must belong to the requesting tenant. Ignored when type='tenant'. Must be empty when type='partner'.
    typestringNoMust be 'webhooks' for this endpoint.

Responses:

StatusDescription
200OK

Response Body — JsonApiScopedDocumentWebhookAttributes:

FieldTypeDescription
dataJsonApiScopedResourceWebhookAttributes
    attributesWebhookAttributesResource-specific fields.
        chainEnabledboolean
        createdAtdatetime
        enabledboolean
        environmentstring
        eventsstring[]
        secretstring
        updatedAtdatetime
        urlstring
    idstringUnique resource identifier (UUID).
    metaJsonApiMetaResource-level meta object carrying the ownership scope (tenant vs legal-entity).
        scopeJsonApiScope
            typestringScope type. 'tenant' = applies to the whole tenant. 'legal-entity' = applies only to the Peppol ID given in 'value'. 'partner' = applies to all child tenants of the calling partner tenant; 'value' must be empty.
            valuestringRequired when type='legal-entity': the Peppol ID (scheme:identifier) that owns this resource, e.g. '9938:lu28079289'. Must belong to the requesting tenant. Ignored when type='tenant'. Must be empty when type='partner'.
    typestringResource type — matches the endpoint (e.g. 'email-templates', 'notification-emails').
cURL Request
curl -X PATCH https://gateway.vigasoft.lu/bizzlink/webhooks/{id} \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "X-Bizzlink-Signature: t=$TIMESTAMP,v1=$SIGNATURE" \
  -H "Content-Type: application/json" \
  -d '{
      "data": {}
  }'
Response 200 OK
{
    "data": {
      "attributes": {
        "chainEnabled": false,
        "createdAt": "2026-01-01T00:00:00Z",
        "enabled": false,
        "environment": "string",
        "events": ["string"],
        "secret": "string",
        "updatedAt": "2026-01-01T00:00:00Z",
        "url": "string"
    },
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "meta": {
        "scope": {
          "type": "legal-entity",
          "value": "9938:lu28079289"
      }
    },
      "type": "email-templates"
  }
}

Rotate the webhook signing secret

POST /bizzlink/webhooks/{id}/actions/rotate-secret
Rotate the webhook signing secret

Responses:

StatusDescription
200OK

Response Body — JsonApiScopedDocumentWebhookAttributes:

FieldTypeDescription
dataJsonApiScopedResourceWebhookAttributes
    attributesWebhookAttributesResource-specific fields.
        chainEnabledboolean
        createdAtdatetime
        enabledboolean
        environmentstring
        eventsstring[]
        secretstring
        updatedAtdatetime
        urlstring
    idstringUnique resource identifier (UUID).
    metaJsonApiMetaResource-level meta object carrying the ownership scope (tenant vs legal-entity).
        scopeJsonApiScope
            typestringScope type. 'tenant' = applies to the whole tenant. 'legal-entity' = applies only to the Peppol ID given in 'value'. 'partner' = applies to all child tenants of the calling partner tenant; 'value' must be empty.
            valuestringRequired when type='legal-entity': the Peppol ID (scheme:identifier) that owns this resource, e.g. '9938:lu28079289'. Must belong to the requesting tenant. Ignored when type='tenant'. Must be empty when type='partner'.
    typestringResource type — matches the endpoint (e.g. 'email-templates', 'notification-emails').
cURL Request
curl -X POST https://gateway.vigasoft.lu/bizzlink/webhooks/{id}/actions/rotate-secret \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "X-Bizzlink-Signature: t=$TIMESTAMP,v1=$SIGNATURE" \
  -H "Content-Type: application/json"
Response 200 OK
{
    "data": {
      "attributes": {
        "chainEnabled": false,
        "createdAt": "2026-01-01T00:00:00Z",
        "enabled": false,
        "environment": "string",
        "events": ["string"],
        "secret": "string",
        "updatedAt": "2026-01-01T00:00:00Z",
        "url": "string"
    },
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "meta": {
        "scope": {
          "type": "legal-entity",
          "value": "9938:lu28079289"
      }
    },
      "type": "email-templates"
  }
}

Send a test webhook

POST /bizzlink/webhooks/{id}/actions/test
Send a test webhook

Responses:

StatusDescription
200OK

Response Body — WebhookTestResponse:

FieldTypeDescription
httpStatusinteger
messagestring
successboolean
cURL Request
curl -X POST https://gateway.vigasoft.lu/bizzlink/webhooks/{id}/actions/test \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "X-Bizzlink-Signature: t=$TIMESTAMP,v1=$SIGNATURE" \
  -H "Content-Type: application/json"
Response 200 OK
{
    "httpStatus": 0,
    "message": "string",
    "success": false
}