Incoming Webhooks

Incoming webhooks help you bring information from a third-party application or an API request into Zoho Commerce whenever an event occurs. In Zoho Commerce, you can use actions in a third-party app as triggers to automate tasks in your organization. This is especially useful when you want to update records, create workflows, or initiate actions without manual effort.

Scenario: Zylker is an online retailer that manages product orders and fulfillment through Zoho Commerce. When a customer places an order in a partner application, the order details are sent to Zoho Commerce through an incoming webhook. Based on the webhook trigger, Zoho Commerce can automatically create the required record or perform a predefined action, saving time and reducing manual data entry.

You can use incoming webhooks to connect Zoho Commerce with external systems and automate actions based on business events.

Note: Incoming webhooks are useful when a third-party service needs to notify Zoho Commerce about an event in real time. If a service doesn’t support OAuth or if you want a simpler setup, you can use a ZAPI key URL.

Create an Incoming Webhook

To create an incoming webhook in Zoho Commerce:

Go to Settings on the top right corner of the page.
Select Incoming Webhooks under Developer Data.
Click + New Incoming Webhook or Create Incoming Webhook.
Enter a Name and Description for the incoming webhook.
In the Deluge editor, write the function you want to execute when the incoming webhook is triggered.
Click Save.

When you save the incoming webhook, Zoho Commerce generates an OAuth URL and a ZAPI Key URL. You can copy the URL from the pop-up that appears.

You can also copy the URLs later by clicking the dropdown next to the incoming webhook in the list page or from the Edit page.

Insight: If your third-party app supports OAuth, use the OAuth URL. If it does not support OAuth or if you want a simpler method to authenticate the request, use the ZAPI Key URL.

Pro Tip: Limit access to the URL to trusted and authorized users. If the URL is exposed, anyone with access to it may trigger the function and execute actions in Zoho Commerce.

You can now configure the generated URL in the third-party application to set up the incoming webhook. If you want to add any additional attributes to the script, you can do so at the time of the API call.

Attribute	Description
Header	The header of the API request.
Parameters	The query parameters included in the API request.
Body	The request payload or the data sent in the API call.

After the configuration is complete, the incoming webhook is created and ready to use.

Once the trigger condition is met in the third-party application, the incoming webhook runs and the action defined in the Deluge function is executed in Zoho Commerce.

View Logs

You can view the execution details of all incoming webhooks that have been triggered in Zoho Commerce from the Edit page of the incoming webhook.

To view logs:

Go to Settings on the top right corner of the page.
Select Incoming Webhooks under Developer Data.
Hover over and click the dropdown next to the incoming webhook you want to modify.
Select View Logs from the dropdown or click View Logs in the top of the page.

The log page shows information about the webhook call, such as the request details, status, and timestamps. Use this data to troubleshoot issues and confirm successful execution.

Edit an Incoming Webhook

If you need to make changes to an incoming webhook, you can edit it from the list page or the edit page.

To edit an incoming webhook:

Go to Settings on the top right corner of the page.
Select Incoming Webhooks under Developer Data.
Hover over and click the dropdown next to the incoming webhook you want to modify.
Select Edit from the dropdown.
Make the necessary changes and click Save.

You can update the name, description, or the Deluge function as required.

Delete an Incoming Webhook

If you no longer need an incoming webhook, you can delete it.

Warning: Once you delete an incoming webhook, it cannot be restored. Any third-party configuration pointing to the deleted webhook will no longer work until it is updated.

To delete an incoming webhook:

Go to Settings on the top right corner of the page.
Select Incoming Webhooks under Developer Data.
Hover over and click the dropdown next to the incoming webhook you want to delete.
Select Delete from the dropdown.
In the confirmation pop-up, click Delete.

You should also remove the corresponding webhook configuration from the third-party app to avoid any failed or stale integrations.

Regenerate ZAPI Key URL

The ZAPI key is included in the invoking URL as part of the query parameter. Since it is embedded in the URL, it requires no additional configuration. However, if the ZAPI Key URL is exposed, anyone with access to it can trigger the webhook and execute the function.

If this happens, regenerate the URL.

To regenerate the ZAPI Key URL:

Go to Settings on the top right corner of the page.
Select Incoming Webhooks under Developer Data.
Hover over and click the dropdown next to the incoming webhook you want to modify.
Select Edit from the dropdown.
Under the ZAPI Key URL field, click Regenerate.

After regeneration, ensure you replace the old URL with the new one wherever it is used in the external application or integrations.