fetchWebhookSettings

POST/management/settings/fetchWebhookSettings

Your current webhook configuration — both destinations, in one read.

legacyUrl is included so you can see what OneTablet still has on file for the legacy feed; the URL itself is never settable through this API — legacyUrlEnabled is (ONE-2877). Never returns an api key — there has never been one on this table (ONE-2777 removed the last column that would have carried one).

A brand-new organization with neither destination configured gets back every field absent/false, never a 404 — "nothing configured yet" is a valid, readable state, not an error.

Request

application/json

required

{}

Responses

200 — OK

legacyUrlstring
The legacy orders-only feed's registered url. READ-ONLY through this API — absent when nothing is configured. Gated by Organization.webhookOrderNotificationsEnabled, unchanged by anything on this contract, and (ONE-2877) by legacyUrlEnabled below.
legacyUrlEnabledboolean
A pause switch for legacyUrl ONLY (ONE-2877) — the sibling of newUrlEnabled for the legacy destination. Unlike legacyUrl itself, this IS settable through setAllWebhookSettings: it is how a partner finishes migrating off the legacy feed without OneTablet clearing legacyUrl as a support action. false silences legacyUrl alone; it has no effect on newUrl. It defaults true, so a destination nobody has ever switched off keeps delivering — including across a setAllWebhookSettings call that does not mention this field at all (ONE-2903).
newUrlstring
The new signed (v2= ES256) destination. Absent when nothing is registered.
newUrlEventsstring[]
Which events are delivered to newUrl. Governs newUrl ONLY — the legacy feed has no per-event list and is always orders-only. Absent/empty when newUrl is absent.
Possible values: [order.created, order.status.updated, order.rejected, order.cancelled, order.delivery.updated, store.status.changed, report.completed, menu.publication.completed]
newUrlEnabledboolean
A pause switch for newUrl ONLY. false silences the new feed; it has no effect on legacyUrl, which has its own gate (Organization.webhookOrderNotificationsEnabled).

About Settings

Read and set where OneTablet delivers your webhooks (ONE-2721).

organizationId is NEVER a field on any request or response here — it is resolved from the authenticated api key, exactly as every other Management API domain resolves it. A partner able to pass an organizationId could redirect another partner's order feed to their own server; the only way that cannot happen is for there to be no parameter that accepts one.

TWO DESTINATIONS, ONE ROW. legacyUrl is the pre-existing orders-only feed — the URL itself is READ-ONLY here (WE control WHERE legacy delivers; cleared only by OneTablet as a support action), gated by the org-wide Organization.webhookOrderNotificationsEnabled flag exactly as it is today, AND (ONE-2877) by legacyUrlEnabled — the self-serve switch that finally lets a partner turn legacy delivery off without asking OneTablet to clear legacyUrl. newUrl is the new signed (v2=, ES256) destination this endpoint lets a partner register for themselves, together with newUrlEvents (which events it receives) and newUrlEnabled (its own pause switch). Any combination of legacyUrlEnabled / newUrlEnabled is valid at once — legacy-only (today's state for Sizl and Profit Cookers), dual-run while migrating, or new-only once a partner is done — and registering/pausing one destination never touches the other.

THE NAMING CARRIES THE SEMANTICS. newUrlEvents and newUrlEnabled govern newUrl ONLY; legacyUrlEnabled governs legacyUrl ONLY — the legacy feed has no per-event subscription list and is always orders-only. Do not read newUrlEnabled: false as "webhooks are off" — it silences newUrl alone, exactly as legacyUrlEnabled: false silences only legacyUrl.

STORAGE: one row per organization, upserted ON CONFLICT ("organizationId") DO UPDATE — see SettingsRepository. No producer reads newUrl/newUrlEvents yet (that is ONE-2697); this contract is registration only.