Outbound webhooks let Pendulum push events to any HTTPS endpoint as they happen. Use them to keep your CRM in sync, feed your accounting system, post to Slack, or wire up a Zapier flow that does something custom when an invoice goes overdue.
What fires
invoice.created: a new invoice was tracked from a Shopify order or draft.invoice.paid: the invoice transitioned to paid.invoice.overdue: the invoice crossed its due date (fires once per invoice).reminder.sent: a reminder email was sent.
Setup
- Open Webhooks in the Pendulum app.
- Paste your HTTPS endpoint URL. Click Create endpoint.
- Copy the signing secret shown once. You will not see it again. Store it as an environment variable in the service that receives the webhooks.
- Pendulum will POST to your endpoint within a few seconds of every event firing.
https://webhook.site/<uuid>, not the one with #!/view/ in the path. Pendulum rejects URLs with fragments to catch this mistake at create time.Security
Every delivery includes an HMAC signature in the X-Pendulum-Signature header. Verify it against the raw request body using your signing secret before trusting the payload. Reject requests older than 5 minutes to prevent replay.
Full reference (HMAC verification code in Node and Python, headers, payload schemas, retry behavior) lives at the webhooks developer docs.
Delivery semantics
- At-least-once. Deduplicate using the
X-Pendulum-Deliveryheader (also in the body asid). - Pendulum expects a 2xx response within 10 seconds.
- Failed deliveries retry on a 1m, 5m, 30m, 2h, 6h, 24h backoff. Roughly 32 hours total before drop.
- An endpoint that fails 10 deliveries in a row auto-deactivates. Pendulum emails you when this happens so you know to look. Re-enable from the Webhooks tab once your service is healthy.
What happens if I downgrade from Pro?
Pendulum stops dispatching events. Existing endpoints stay in your settings (we don't auto-delete) but no new deliveries fire. Re-upgrade and dispatch resumes automatically.