Show Webhook Settings
GET/api/xero/webhook-settings/:integrationInstanceId
Current real-time sync settings for one Xero connection.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
SKU.io receives Xero webhooks through a single shared application: there is one delivery URL and one signing key for the whole platform, and neither is per-connection, so neither is configured or read back here. What a connection controls is whether it acts on delivered events at all, and which event categories it acts on. The ops block is read-only health and configuration information about that shared receiver.
Response fields:
integration_instance_id(integer): the Xero connection these settings belong to.webhook_enabled(boolean): whether this connection acts on the events Xero delivers. A connection that has never been toggled readstrue.categories(object): per-category processing switches, keyed by category —CONTACT,INVOICE,CREDITNOTE— each a boolean. Every known category is always present; a category that has never been toggled readstrue, so a new connection processes everything until a type is switched off.supported_categories(array of strings, read-only): the subset of categories SKU.io currently does something with. Switching on a category that is not in this list has no effect — its events are still recorded, but they are markedignoredand no data is fetched from Xero for them. Read this rather than assuming all three categories are live; the list grows as more inbound syncs ship.ops.delivery_url(string, read-only): the single platform-wide URL Xero delivers every organisation's events to.ops.signing_key_configured(boolean, read-only): whether the platform-wide signing key is in place.ops.subscribed_topics(array of strings, read-only): the event categories the shared Xero application is subscribed to — what Xero sends, as opposed tosupported_categories, which is what SKU.io acts on.ops.events_last_24h(integer, read-only): events received for this connection in the last 24 hours.ops.last_failure_at(ISO-8601 datetime or null, read-only) andops.last_failure_message(string or null, read-only): when the connection's most recent event failed, and why. Both null when nothing has failed.
Path parameters:
integrationInstanceId(integer, required): Xero integration instance ID.
Returns 404 when the Xero connection does not exist.
Authentication: Bearer token.
Request
Responses
- 200
- 401
- 403
- 404
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not found — no record with the given identifier (or the route does not exist). Verify the ID before retrying.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.