Create a catalog webhook endpoint

POST

catalog

webhooks

cURL

curl --request POST \
  --url https://app.productlasso.com/api/v1/catalog/webhooks \
  --header "Authorization: Bearer $LASSO_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "ERP product sync",
    "url": "https://erp.example.com/webhooks/lasso",
    "events": ["product.created", "product.updated", "product.deleted"]
  }'

const response = await fetch("https://app.productlasso.com/api/v1/catalog/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.LASSO_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "ERP product sync",
    url: "https://erp.example.com/webhooks/lasso",
    events: ["product.created", "product.updated", "product.deleted"],
  }),
});

if (!response.ok) throw new Error(await response.text());
const webhook = await response.json();
// Store webhook.secret now. It is returned only once.

import os
import requests

response = requests.post(
    "https://app.productlasso.com/api/v1/catalog/webhooks",
    headers={"Authorization": f"Bearer {os.environ['LASSO_API_KEY']}"},
    json={
        "name": "ERP product sync",
        "url": "https://erp.example.com/webhooks/lasso",
        "events": ["product.created", "product.updated", "product.deleted"],
    },
    timeout=30,
)
response.raise_for_status()
webhook = response.json()
# Store webhook["secret"] now. It is returned only once.

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "company_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "url": "<string>",
  "events": [
    "product.created"
  ],
  "enabled": true,
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "secret": "<string>",
  "description": "<string>"
}

{
  "status_code": 123,
  "error_type": "invalid_request",
  "message": "<string>",
  "request_id": "<string>",
  "code": "<string>",
  "retryable": true,
  "attribute_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "attribute_key": "<string>",
  "details": {},
  "current_updated_at": "2023-11-07T05:31:56Z"
}

{
  "status_code": 123,
  "error_type": "invalid_request",
  "message": "<string>",
  "request_id": "<string>",
  "code": "<string>",
  "retryable": true,
  "attribute_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "attribute_key": "<string>",
  "details": {},
  "current_updated_at": "2023-11-07T05:31:56Z"
}

Save the signing secret

The 201 response includes secret exactly once. Store it securely before discarding the response. List and update operations never return it again.

Production destinations must use public HTTPS. Lasso validates DNS and rejects local, private, and otherwise unsafe targets.
events must contain at least one unique supported event.
name is optional for API clients and defaults to the destination hostname.

Verify signatures using the raw request body. See Catalog webhooks for headers, signature verification, retries, and payloads.

Examples

curl --request POST \
  --url https://app.productlasso.com/api/v1/catalog/webhooks \
  --header "Authorization: Bearer $LASSO_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "ERP product sync",
    "url": "https://erp.example.com/webhooks/lasso",
    "events": ["product.created", "product.updated", "product.deleted"]
  }'

const response = await fetch("https://app.productlasso.com/api/v1/catalog/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.LASSO_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "ERP product sync",
    url: "https://erp.example.com/webhooks/lasso",
    events: ["product.created", "product.updated", "product.deleted"],
  }),
});

if (!response.ok) throw new Error(await response.text());
const webhook = await response.json();
// Store webhook.secret now. It is returned only once.

import os
import requests

response = requests.post(
    "https://app.productlasso.com/api/v1/catalog/webhooks",
    headers={"Authorization": f"Bearer {os.environ['LASSO_API_KEY']}"},
    json={
        "name": "ERP product sync",
        "url": "https://erp.example.com/webhooks/lasso",
        "events": ["product.created", "product.updated", "product.deleted"],
    },
    timeout=30,
)
response.raise_for_status()
webhook = response.json()
# Store webhook["secret"] now. It is returned only once.

Example response

{
  "id": "f4146cf6-393e-411f-a93e-b62212e7b5c1",
  "company_id": "81e2b625-e6e8-4dd5-a50f-22803806cc10",
  "name": "ERP product sync",
  "url": "https://erp.example.com/webhooks/lasso",
  "events": ["product.created", "product.updated", "product.deleted"],
  "enabled": true,
  "description": null,
  "secret": "whsec_store_this_value_now",
  "created_at": "2026-08-31T09:40:00.000Z",
  "updated_at": "2026-08-31T09:40:00.000Z"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

url

string<uri>

required

Maximum string length: 2048

events

enum<string>[]

required

Minimum array length: 1

Available options:

product.created,

product.updated,

product.deleted,

attribute.created,

attribute.updated,

attribute.deleted

name

string

Optional for API clients; defaults to the destination hostname. The dashboard requires it.

Required string length: 1 - 120

description

string | null

Maximum string length: 500

Response

Endpoint plus its one-time signing secret

string<uuid>

required

company_id

string<uuid>

required

name

string

required

Required string length: 1 - 120

url

string<uri>

required

HTTPS public destination. HTTP localhost is accepted only by local development servers.

events

enum<string>[]

required

Minimum array length: 1

Available options:

product.created,

product.updated,

product.deleted,

attribute.created,

attribute.updated,

attribute.deleted

enabled

boolean

required

created_at

string<date-time>

required

updated_at

string<date-time>

required

secret

string

required

One-time signing secret. It is never returned by later reads or updates.

description

string | null

Maximum string length: 500

cURL

curl --request POST \
  --url https://app.productlasso.com/api/v1/catalog/webhooks \
  --header "Authorization: Bearer $LASSO_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "ERP product sync",
    "url": "https://erp.example.com/webhooks/lasso",
    "events": ["product.created", "product.updated", "product.deleted"]
  }'

const response = await fetch("https://app.productlasso.com/api/v1/catalog/webhooks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.LASSO_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    name: "ERP product sync",
    url: "https://erp.example.com/webhooks/lasso",
    events: ["product.created", "product.updated", "product.deleted"],
  }),
});

if (!response.ok) throw new Error(await response.text());
const webhook = await response.json();
// Store webhook.secret now. It is returned only once.

import os
import requests

response = requests.post(
    "https://app.productlasso.com/api/v1/catalog/webhooks",
    headers={"Authorization": f"Bearer {os.environ['LASSO_API_KEY']}"},
    json={
        "name": "ERP product sync",
        "url": "https://erp.example.com/webhooks/lasso",
        "events": ["product.created", "product.updated", "product.deleted"],
    },
    timeout=30,
)
response.raise_for_status()
webhook = response.json()
# Store webhook["secret"] now. It is returned only once.

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "company_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "name": "<string>",
  "url": "<string>",
  "events": [
    "product.created"
  ],
  "enabled": true,
  "created_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "secret": "<string>",
  "description": "<string>"
}

{
  "status_code": 123,
  "error_type": "invalid_request",
  "message": "<string>",
  "request_id": "<string>",
  "code": "<string>",
  "retryable": true,
  "attribute_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "attribute_key": "<string>",
  "details": {},
  "current_updated_at": "2023-11-07T05:31:56Z"
}

{
  "status_code": 123,
  "error_type": "invalid_request",
  "message": "<string>",
  "request_id": "<string>",
  "code": "<string>",
  "retryable": true,
  "attribute_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "attribute_key": "<string>",
  "details": {},
  "current_updated_at": "2023-11-07T05:31:56Z"
}

Overview

Search

Enrich

Tables

Rows

Enhance

Schemas

Attributes

Files

Glossary

Credits

Product analytics

Catalog

Catalog Webhooks

Create a catalog webhook endpoint

Save the signing secret

Examples

Authorizations

Body

Response

​Save the signing secret

​Examples

Authorizations

Body

Response

Save the signing secret

Examples