> ## Documentation Index
> Fetch the complete documentation index at: https://www.zinc.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Webhook Endpoint

> Register or replace the URL Zinc POSTs this account's order and return events to.

Registers the single URL every order and return event for this account is POSTed to.

```bash theme={null}
curl -X PUT https://api.zinc.com/webhooks/endpoint \
  -H "Authorization: Bearer ***" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/zinc/webhook"}'
```

A signing secret is generated on first registration and returned in the response. Replacing the URL later **keeps the existing secret**, so moving your endpoint never invalidates the verification you already have in place.

<Info>
  This is how an API-key-only caller registers a webhook. An agent whose key came from [`POST /agent/orders`](/docs/v2/api-reference/agent/create-order) has no dashboard login, so this endpoint is its only route to event delivery.
</Info>

Store `webhook_secret` and check the `X-Webhook-Signature` header on every delivery — see [Webhooks](/docs/v2/api-reference/introduction/webhooks).


## OpenAPI

````yaml versions/latest.json PUT /webhooks/endpoint
openapi: 3.1.0
info:
  title: Zinc
  summary: >-
    Zinc lets you search, buy, and return items from top online retailers with a
    single API.
  description: >-
    Search, buy, and return items from top online retailers with a single API.
    Supports AI agent ordering via MPP (HTTP 402) — no account required.
    Supported retailers include 1-800-Flowers, Ace Hardware, Amazon, Amazon DE,
    Barnes & Noble, Best Buy, Chewy, Gap, IBS, Lowe's, Macys, Partstown, and 12
    more. Ships to the US and 2 other countries (DE, IT).
  version: '2026-08-21'
  x-logo:
    url: https://mintlify.s3.us-west-1.amazonaws.com/zinc/logo/light.png
  contact:
    name: Zinc API Support
    email: support@zinc.com
    url: https://zinc.com/docs
  x-guidance: >-
    Zinc lets AI agents buy products from online retailers via a single API. Use
    POST /agent/orders to place an order — no Zinc account needed, payment is
    handled via MPP (HTTP 402 flow). Provide a product URL from a supported
    retailer, a shipping address, and max_price in cents. The API charges
    max_price + $1 API fee upfront and refunds the difference on completion. To
    find products first, the /agent/* data endpoints (search, products/search,
    products/offers, products/details) are MPP-paid at $0.01 per call;
    /agent/search returns orderable URLs to feed straight into /agent/orders.
    GET /retailers lists supported retailers for free (no payment or account).
    Authenticated equivalents (orders, products, managed-accounts) require a
    Bearer token (API key prefixed zn_); those orders are paid from a prefunded
    wallet — GET /wallet/me returns the spendable balance and per-order fee, so
    check it before POST /orders to avoid a 402. Docs: https://zinc.com/docs
    Supported retailers include 1-800-Flowers, Ace Hardware, Amazon, Amazon DE,
    Barnes & Noble, Best Buy, Chewy, Gap, IBS, Lowe's, Macys, Partstown, and 12
    more, shipping to the US and 2 other countries (DE, IT).
  x-supported-retailers:
    - 1-800-Flowers
    - Ace Hardware
    - Amazon
    - Amazon DE
    - Barnes & Noble
    - Best Buy
    - Chewy
    - Gap
    - IBS
    - Lowe's
    - Macys
    - Partstown
    - Pokémon Center
    - Sephora
    - Target
    - The Home Depot
    - TikTok
    - Uniqlo
    - Walmart
    - Wayfair
    - Zinc
    - eBay
    - libraccio
    - zazzle
  x-supported-countries:
    - US
    - DE
    - IT
servers:
  - url: https://api.zinc.com
    description: Production
security:
  - BearerAuth: []
paths:
  /webhooks/endpoint:
    put:
      tags:
        - webhooks
      summary: Set Webhook Endpoint
      description: >-
        Register (or replace) the webhook URL for this account.


        Every order and return event Zinc emits for the account is POSTed to
        this

        URL. A signing secret is generated on first registration and returned so

        the caller can verify the ``X-Webhook-Signature`` header; replacing the
        URL

        keeps the existing secret, so a URL move never invalidates verification.
      operationId: set_webhook_endpoint_webhooks_endpoint_put
      parameters:
        - name: authorization
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Authorization
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookEndpointUpdate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpointResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    WebhookEndpointUpdate:
      properties:
        url:
          type: string
          title: Url
          description: Absolute http(s) URL that receives order and return events.
          examples:
            - https://example.com/zinc/webhook
      type: object
      required:
        - url
      title: WebhookEndpointUpdate
      description: 'Body for ``PUT /webhooks/endpoint``: the single URL Zinc delivers to.'
    WebhookEndpointResponse:
      properties:
        webhook_url:
          anyOf:
            - type: string
            - type: 'null'
          title: Webhook Url
        webhook_secret:
          anyOf:
            - type: string
            - type: 'null'
          title: Webhook Secret
      type: object
      required:
        - webhook_url
        - webhook_secret
      title: WebhookEndpointResponse
      description: |-
        The caller's webhook endpoint: where events go and the HMAC secret that
        signs them. Both are null until registered.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    BearerAuth:
      type: apiKey
      in: header
      name: Authorization
      description: Zinc API key (Bearer zn_...)

````