Webhooks, Developer API and Plans
Developer API
Besides webhooks, Etalasse provides a merchant API that can be accessed with a personal access token (PAT). Tokens start with eta_pat_ and act as the Owner, so store them like a password and never put them in client code or a repository.
The full description of the API that a PAT can reach is in the OpenAPI file: etalasse-api/docs/openapi.yaml. The webhook routes (creating endpoints, viewing the log, redelivering, and more) can also be used with a PAT, so endpoint management can be automated.
Plans and limits
| Plan | Webhooks | Maximum endpoints |
|---|---|---|
| Free | No | - |
| Growth | No | - |
| Pro | Yes | 3 |
| Enterprise | Yes | 10 |
The hard cap of 10 endpoints per shop applies in every case.
If your plan is downgraded
Existing endpoints are not deleted, but they stop receiving new events (events are not even recorded for them). What still works: viewing the endpoint list and details, deleting endpoints, and viewing the delivery log. What needs the plan: creating and editing endpoints (including re-enabling), secret rotation, sending tests, redelivery, and replay.
Error codes
Error responses look like { "status": false, "code": "...", "message": "...", "field": "..." } (field only when relevant).
| HTTP | Code | When |
|---|---|---|
| 402 | PLAN_LIMIT | The plan lacks webhooks, or the plan's endpoint limit is used up |
| 403 | (role) | Cashier account |
| 404 | NOT_FOUND | The endpoint, delivery, or event is missing or belongs to another shop |
| 409 | ENDPOINT_LIMIT | Already 10 endpoints (hard cap) |
| 409 | DUPLICATE_URL | That URL is already registered in your shop |
| 409 | ENDPOINT_INACTIVE | Redeliver or replay to a disabled endpoint |
| 422 | VALIDATION_ERROR | Invalid input (field: url, events, description, overlap_hours) |
| 422 | URL_SCHEME, URL_INVALID, URL_CREDENTIALS, URL_HOST_BLOCKED, URL_PORT_BLOCKED, ADDRESS_BLOCKED, DNS_FAILED | URL refused, see the URL rules |
| 429 | RATE_LIMITED | Too many test sends (maximum 10 per minute) |
FAQ
Why can't I add an endpoint?
Check your plan (Pro or Enterprise), your endpoint count against the plan limit, and your account role (Owner or Admin).
I lost my secret. What now?
Rotate the secret. The old secret cannot be shown again.
My endpoint was suddenly disabled.
It was probably disabled automatically after consecutive failures. Fix the server, re-enable it, then replay the events you missed.
My event arrived twice.
That is normal with at-least-once delivery. Ignore events whose id you already processed.
Events arrive out of order.
Ordering is not guaranteed. Use the timestamps in the data.
Is cost data or a password sent?
No. See what is never sent.
How long are logs kept?
30 days.