Configure and inspect Webhooks

Webhooks are HTTP calls (callbacks) that our server makes to yours when an important event occurs asynchronously (e.g., a quote was approved or paid).

Registering an endpoint

To receive webhooks, expose a POST route on your server (e.g., https://api.yourcompany.com/webhooks/cord).

1. Turn on Developer mode in Your account › Preferences. The Developers pill appears in the bottom-right corner: open it (or press W) and go to the Workbench’s Webhooks tab (/app?wb=webhooks).
2. Click Add endpoint and choose the events: All events, a whole family, or individual events. The search box filters the 41 events by name.
3. Enter your URL, public and over HTTPS, and click Create endpoint. The signing secret is shown only once: store it.

Available events

Cord emits quote lifecycle events and, separately, events for the invoice as its own object (see Invoicing and the API):

• quote.sent — sent to the customer.
• quote.viewed — the customer opened it.
• quote.approved — the customer approved it.
• quote.rejected — the customer rejected it.
• quote.updated — it was edited and resent.
• quote.expired — it expired without a response.
• quote.deleted — a draft was deleted.
• quote.paid — it was paid in full.
• payment.partial — a deposit, balance, or installment was collected without covering the full total.
• payment.failed — a recurring charge failed.
• invoice.issued, invoice.stamped — a quote’s invoice was issued: a commercial invoice outside Mexico or a stamped CFDI.
• invoice.finalized, invoice.sent, invoice.paid, invoice.payment_failed, invoice.voided, invoice.marked_uncollectible, invoice.overdue — lifecycle of an invoice created as its own resource via /api/v1/facturas.
• quote.created, quote.approval_requested, quote.approval_decided, quote.comment_added — a quote was created, an internal approval was requested or decided, or someone wrote in the conversation.
• client.created, client.updated, client.deleted, product.created, product.updated, product.deleted — changes to your client directory and catalog.
• task.created, task.completed, promise.created, promise.kept, promise.broken — tasks and payment promises.
• dispute.created, dispute.closed, refund.succeeded, refund.failed, payout.paid, payout.failed, account.updated — disputes, refunds, payouts, and changes to your payments account.

With All events, the endpoint also receives any events Cord adds later.

The body is JSON: { "id": "evt_...", "event": "quote.paid", "created_at": "...", "data": { "id", "folio", "status", "moneda", "total", "cliente", "cliente_id", "link_publico" } }. The event’s id is stable across retries and a manual redelivery from the Workbench — use it to deduplicate on your side.

Signature verification

Always validate the signature to ensure the event comes from Cord. Every delivery includes X-Cord-Signature-V1 (with a timestamp, replay protection) and, for backward compatibility, the legacy X-Cord-Signature (no timestamp). The event name travels in X-Cord-Event and its stable id in X-Cord-Event-Id/Idempotency-Key. On Node, constructEvent from @flouviahq/node validates it for you; if you’d rather verify it by hand in any language, see the verification code.

Retries and inspection

Each endpoint’s Test button sends a test delivery: ping or any event it is subscribed to, with sample data and "test": true at the top level of the body.

Expanding an endpoint shows its delivery log (status, latency, and response for every attempt), and opening one shows what Cord sent and what your server responded. If a delivery fails, you retry it from there or resend the event from the Events tab. Delivery history, retry, and resend are part of the Professional plan or higher.