> For the complete documentation index, see [llms.txt](https://developers.bead.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.bead.xyz/entity-management/terminal-management/webhook-management.md).

# Webhook Management

Configure or remove the default webhook URL for a terminal. Each terminal can have one default webhook URL for payment status events. You can also provide payment-specific webhook URLs when creating a payment.

**Set or update the webhook URL**

Use this operation to create or replace the default payment status webhook URL for a terminal.

**Endpoint**

`PUT https://api.test.devs.beadpay.io/Terminals/{id}/webhook`

**Authentication**

Use your **admin API key** in the request header for terminal management operations. This endpoint does not accept a terminal payments API key. Using a terminal payments API key will return `403 Forbidden`.

**Request headers**

| Header         | Value              |
| -------------- | ------------------ |
| `X-Api-Key`    | `{adminApiKey}`    |
| `Content-Type` | `application/json` |
| `Accept`       | `application/json` |

**Path parameter**

| Name | Type   | Description                                                                       |
| ---- | ------ | --------------------------------------------------------------------------------- |
| `id` | string | Terminal identifier returned by Create Terminal, List Terminals, or Get Terminal. |

**Request body**

| Field | Type         | Required | Description                                                                                                       |
| ----- | ------------ | -------- | ----------------------------------------------------------------------------------------------------------------- |
| `url` | string (URI) | Yes      | Fully qualified HTTPS URL where terminal-level payment status events should be delivered. Maximum 512 characters. |

**Example request**

```bash
curl --request PUT "https://api.test.devs.beadpay.io/Terminals/67f10123456789abcdef0456/webhook" \
  --header "X-Api-Key: {adminApiKey}" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json" \
  --data '{
    "url": "https://yourapp.com/webhooks/payment-status"
  }'
```

**Example response**

```json
{
  "url": "https://yourapp.com/webhooks/payment-status",
  "signingSecret": "{base64EncodedSecret}"
}
```

Store `signingSecret` securely. Use it to verify the `x-webhook-signature` header on all incoming terminal webhook deliveries. Treat it like a password and do not log it or expose it in client-side code.

**Success responses**

| Code  | Meaning                                  |
| ----- | ---------------------------------------- |
| `200` | Webhook URL set or updated successfully. |
| `202` | Request accepted for processing.         |
| `204` | Request completed with no response body. |

**Error responses**

| Code  | Meaning                                                                                                                                              |
| ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| `400` | The request body is invalid, such as a missing or malformed URL.                                                                                     |
| `401` | The admin API key is missing or invalid.                                                                                                             |
| `403` | The caller is authenticated but not permitted to manage the specified terminal, or a terminal payments API key was used instead of an admin API key. |
| `404` | No terminal was found for the supplied `id`.                                                                                                         |
| `409` | A conflicting terminal state prevented the update.                                                                                                   |

**Delete the webhook URL**

Use this operation to remove the default webhook URL from a terminal. After removal, terminal-level payment status events are no longer delivered to a default webhook URL.

**Endpoint**

`DELETE https://api.test.devs.beadpay.io/Terminals/{id}/webhook`

**Authentication**

Use your **admin API key** in the request header for terminal management operations.

**Request headers**

| Header      | Value              |
| ----------- | ------------------ |
| `X-Api-Key` | `{adminApiKey}`    |
| `Accept`    | `application/json` |

**Path parameter**

| Name | Type   | Description                                                                       |
| ---- | ------ | --------------------------------------------------------------------------------- |
| `id` | string | Terminal identifier returned by Create Terminal, List Terminals, or Get Terminal. |

**Example request**

```bash
curl --request DELETE "https://api.test.devs.beadpay.io/Terminals/67f10123456789abcdef0456/webhook" \
  --header "X-Api-Key: {adminApiKey}" \
  --header "Accept: application/json"
```

**Success response**

`204 No Content` — no response body is returned on success.

**Error responses**

| Code  | Meaning                                                                         |
| ----- | ------------------------------------------------------------------------------- |
| `400` | The request is invalid.                                                         |
| `401` | The admin API key is missing or invalid.                                        |
| `403` | The caller is authenticated but not permitted to manage the specified terminal. |
| `404` | No terminal was found for the supplied `id`.                                    |

**Signature verification**

When you set or update a terminal webhook, the response includes a `signingSecret`. Store it securely — you will use it to verify the `x-webhook-signature` header on every incoming terminal webhook delivery.

The signature header format is:

```
x-webhook-signature: t=1781811428956,s=FK/SW9lIK0CXpNnfweTN3ZbJ8Nvbm1RF69Nm6XE8w3O=
```

Where `t` is a Unix epoch timestamp in **milliseconds** and `s` is a **Base64-encoded** HMAC-SHA256 digest of the signed message `t + "." + rawBody`, computed using the base64-decoded bytes of `signingSecret` as the HMAC key.

For full verification steps and a Node.js code example, see [How do I verify that a webhook really came from Bead?](/faqs-and-troubleshooting/webhooks-and-error-codes/how-do-i-verify-that-a-webhook-really-came-from-bead.md)

**Delivery behavior**

The terminal webhook is the default event destination for all payments on that terminal. You can also supply payment-specific `webhookUrls` when creating a payment if a single payment needs additional event destinations.

Note that `x-webhook-signature` is only included on terminal-level webhook deliveries. It is not present on per-payment deliveries sent to `webhookUrls`.

**Best practices**

* Return a `2xx` response quickly from your webhook consumer.
* Make webhook processing idempotent so retries do not create duplicate work.
* Use environment-specific webhook URLs for Sandbox and Production.
* Treat the signing secret like any other credential and do not log it or expose it in client-side code.

**Notes**

* The request body field is `url`, not `webhookUrl`.
* Use your **admin API key** for terminal webhook management.
* Use the terminal payments API key for payment operations only, not for terminal configuration changes.

**Related operations**

* [Create Terminal](/entity-management/terminal-management/create-terminal.md)
* [Get Terminal](/entity-management/terminal-management/get-terminal.md)
* [Update Terminal](/entity-management/terminal-management/update-terminal.md)
* [Delete Terminal](/entity-management/terminal-management/delete-terminal.md)
* [Reset Terminal API Key](/entity-management/terminal-management/reset-terminal-api-key.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developers.bead.xyz/entity-management/terminal-management/webhook-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.