Skip to main content
POST
Register a dispute webhook
This is a public, self-service endpoint. Call https://api.tabby.ai/api/v1/dispute-webhooks (https://api.tabby.sa/api/v1/dispute-webhooks for KSA) with your live secret key and the X-Merchant-Code header. How dispute webhooks work, payload and statuses: Dispute webhooks.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <secret_key>, where <secret_key> is your secret_key.

Headers

X-Merchant-Code
string
required

Merchant code the request is scoped to. Required on every dispute-webhook request, even when your secret key maps to a single merchant; case-insensitive.

Example:

"code provided to you from Tabby side"

Body

application/json
url
string<uri>
required

Endpoint for dispute notifications (HTTPS recommended). Must be an absolute URL with a publicly resolvable host name — localhost, raw IP addresses and hosts that do not resolve are rejected. Normalised before it is stored (lower-case scheme and host, default port and trailing slash removed) and unique per merchant.

Example:

"https://example.com/tabby/dispute-webhook"

header
object

Optional static header Tabby adds to every notification so you can verify its origin. Omit it on PUT to remove the header.

Response

Success. Dispute webhook object is returned; header.value is masked.

id
string
required
read-only

Unique dispute webhook ID, assigned by Tabby.

Example:

"f5eb7c26-b163-4fad-b75f-66024824116e"

url
string<uri>
required

Endpoint for dispute notifications, as stored (normalised).

Example:

"https://example.com/tabby/dispute-webhook"

header
object | null

The signing header, if one was registered. value is masked.