Webhooks and API keys
Notify third-party systems about events via webhooks and connect them with least-privilege API keys.
Skirta:Administratorius2 min skaitymo
Creating a webhook
- Settings → webhooks → new webhook (administrator/owner role).
- Enter the endpoint URL – only
https://in production. - Choose events: all events (*), groups such as
order.*,tour.*,stop.*,document.*,invoice.*,thread.*,customs.*,proposal.*,assignment.*, or your own patterns (comma-separated, max. 50). - Switch it to active and save.
Pastaba: The signing secret (whsec_…) is shown exactly once – store it right away. Rotating the secret creates a new one; the old one is invalid immediately.
Delivery and testing
- Each delivery is a
POSTwith JSON{ id, type, tenantId, occurredAt, payload }and the headersX-LogCon-Signature(HMAC-SHA256 over the raw body),X-LogCon-Event,X-LogCon-Delivery(idempotency key) andX-LogCon-Timestamp. - Your endpoint must reply with 2xx within 10 s; otherwise there are 5 retries with increasing delay (10/20/40/… s).
- Send test event delivers a
webhook.pingimmediately. Deliveries shows the last 50 attempts with time, event, attempt, status, duration and error.
Creating an API key
Usage: header x-api-key: lc_…. A key acts as an administrator, limited by its scopes. Revoke disables it immediately. Platform admin functions can never be reached with API keys.
- Settings → API keys → create API key (administrator/owner role).
- Enter a name and permissions (scopes, comma-separated).
- Copy the
lc_…key straight away – it is shown only once; afterwards only its prefix is visible.
Scopes
| Scope | Meaning |
|---|---|
* or empty | Full access to the tenant |
<resource>:* | Everything on one resource |
<resource>:read | Read only (GET/HEAD) |
<resource>:write | Write, includes read |
Pastaba: Resources are e.g. orders, documents, tours, invoices, partners, webhooks, stock. Recommendation: one key per third-party system with minimal scopes – e.g. TMS import orders:write, documents:write, BI orders:read, invoices:read. Missing scope: 403 api_key_scope. Limit: 600 requests per minute per IP.
Susiję straipsniai
- IntegrationsConnect, test and monitor freight exchange, telematics, accounting, email, routing, geocoding, sanctions list and e-invoicing.
- Managing users and rolesWhat each role may do, how to invite, edit and deactivate users and how driver and portal logins are created.
- Troubleshooting for administratorsTypical symptoms – from mock mode and missing emails to webhook and sign-in problems – with cause and fix.