Events catalog
The 9 real event types you can subscribe to.
Register an endpoint (POST /api/v1/webhooks, requires webhooks:manage) and list the
events you want. VUZ POSTs a signed payload to your URL the moment each event fires.
Events
| Event | Fires when |
|---|---|
document.finalized | A document is finalized (numbered, signed, immutable) |
client.created | A new client is created |
client.updated | A client's details are updated |
product.created | A new product is created |
product.updated | A product's details are updated |
payment.received | A payment is recorded against a document |
quote.accepted | A customer accepts a quote |
quote.rejected | A customer rejects a quote |
expense.uploaded | An expense/receipt is uploaded (accountant-side event) |
checkout.paid | A Payment Page sale is paid and its document is finalized — never earlier |
checkout.failed | A Payment Page checkout reaches a terminal decline (locked out or expired), not every retryable decline |
checkout.activated | A recurring Payment Page checkout tokenizes and its standing order (mandate) activates |
There is no document.created or document.delivered event — documents notify only on
document.finalized (the DRAFT → ISSUED transition). If you were expecting per-draft or
per-delivery events, they don't exist today.
checkout.paid/checkout.failed/checkout.activated are specific to
Payment Pages — a payment recorded against an existing
document you created yourself (e.g. via POST /documents) still fires payment.received,
not checkout.paid. The two are deliberately separate: payment.received is about a
payment against a document you already control; checkout.paid is about a self-serve sale
your customer initiated on a page you configured once.
Register an endpoint
curl -X POST https://api.vuz.co.il/api/v1/webhooks \
-H "X-Api-Key: vuz_..." \
-H "Content-Type: application/json" \
-d '{
"url": "https://your-server.example.com/webhooks/vuz",
"events": ["document.finalized", "payment.received"],
"description": "Sync finalized invoices to my ERP"
}'Every endpoint gets its own randomly generated HMAC secret (returned once, and readable
again via GET /webhooks/{id} if you need to re-verify your signature-checking code) — see
Signature verification.
Test it
POST /api/v1/webhooks/{id}/testFires a synthetic test event at your endpoint so you can confirm connectivity and
signature verification before going live.