O2C Webhooks

Your other systems shouldn't poll the books to find out a deal closed or a payment landed. O2C webhooks push order-to-cash events to any HTTPS endpoint you register, with signed payloads and a full delivery log.

Key capabilities

• Seven subscribable event types: order.countersigned, contract.activated, drawdown.approved, invoice.drafted, invoice.sent, contract.completed, and payment.received
• The Webhooks page lists the seven order-to-cash events. Through the API an endpoint can also subscribe to five month-end close events (accounting_period.created, plaid.sync.completed, stripe.payout.landed, reconciliation.completed, anomaly.created); payload fields are in the webhooks guide
• Nine close events (close.window_opened, close.progress, close_step.overdue, pending_change.proposed, pending_change.decided, approval_round.submitted, approval_round.decided, document_request.fulfilled, transaction_clarification.answered) keep the Agent window up to date on the close. DayZero staff switch on one endpoint per business for it; leave it in place. Their payloads are also in the guide
• Per-endpoint event subscriptions — each endpoint receives only the events it opted into
• HMAC-signed payloads: each endpoint gets a signing secret so receivers can verify authenticity
• The plaintext signing secret is shown once, at creation — store it when you see it
• Delivery log per endpoint: status, attempt count, HTTP response code, and the next retry time while retrying
• Failed deliveries retry automatically with backoff (after 1 minute, 5 minutes, 30 minutes, 2 hours, then 8 hours), and show as failed after six attempts in all
• Test fire sends a sample event, of a type the endpoint subscribes to, to that endpoint only, so you can check your receiver
• Endpoints show as Active or Inactive; an inactive endpoint receives nothing
• Delete an endpoint to stop deliveries (its delivery history is removed with it)

How it works

flowchart LR
  event["O2C event (e.g. payment.received)"] --> match["Subscribed endpoints"]
  match --> sign["HMAC-sign payload"]
  sign --> post["POST to endpoint"]
  post -->|"2xx"| done["Delivered"]
  post -->|"failure"| retry["Retry with backoff"]
  retry --> post

How to use it

1. Open Webhooks in the Order to Cash workspace and click New webhook. Enter the Endpoint URL; it must be HTTPS.
2. Check the Event types it should receive and click Create webhook. Copy the signing secret from the confirmation (Copy secret); it won't be shown again.
3. Verify the HMAC signature (X-DayZero-Signature) on each delivery in your receiver before trusting the payload. The webhooks guide has the headers and a verification example.
4. Use Test fire on the endpoint's row to send a sample event, and Deliveries to debug: status, attempts, response codes, and when the next retry fires.

Pro tips

• Subscribe narrowly — an endpoint that only cares about payment.received shouldn't have to ignore six other event types.
• If you lose a signing secret, rotate it through the API (POST /api/v1/webhooks/o2c/{endpoint_id}/rotate-secret; the old secret keeps signing for up to an hour so your receiver can switch over), or delete the endpoint and re-create it.
• A failed delivery can be re-sent through the API (POST /api/v1/webhooks/o2c/{endpoint_id}/deliveries/{delivery_id}/redeliver) without waiting for the next retry.
• Every delivery carries an X-DayZero-Delivery-Id header, and a retry repeats the same one, so use it to drop duplicates.