curl -X POST 'https://api.fitsociety.io/public/v1/make/accounting/webhooks' -H 'Authorization: Bearer <make_accounting_access_token>' -H 'Idempotency-Key: accounting-enable-001' -H 'Content-Type: application/json' -d '{"event":"invoice.created","url":"https://hook.eu1.make.com/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({event: 'invoice.created', url: '<string>'})
};
fetch('https://api.fitsociety.io/public/v1/make/accounting/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.fitsociety.io/public/v1/make/accounting/webhooks"
payload = {
"event": "invoice.created",
"url": "<string>"
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"id": "66f7b8b1e13c8d25f4d3d90a",
"companyId": "66f7b8b1e13c8d25f4d3d90a",
"event": "invoice.created",
"signingSecret": "string"
},
"meta": {
"requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
"rateLimit": {
"limit": 10,
"remaining": 9,
"resetSeconds": 1
},
"idempotency": {
"replayed": false
}
}
}Subscribe a Make accounting trigger
Requires finance_invoice_webhooks:write and an Idempotency-Key header. Requires an active Make OAuth grant, attributed company administrator consent and Make access for the company. The token and current grant must both contain the required scope. These accounting scopes do not require health-data or private-communication consent. Existing connections need a new explicit authorization to gain the accounting scopes. Public API rate limits and the Retry-After response header apply. Only invoice.created is supported, covering Invoice and CreditNote documents. Only HTTPS callbacks on hook.eu1.make.com, hook.eu2.make.com, hook.us1.make.com or hook.us2.make.com with a 32-character alphanumeric path and no credentials, custom port, query or fragment are accepted. Repeating the same grant and active callback returns its subscription and signing secret; each scenario can use its own callback. Store data.signingSecret securely for signature verification and never map it into module output. Outbound requests use the signed Make string payload, with companyId and data.resourceId references. A new enable cycle after deletion requires a fresh Idempotency-Key.
curl -X POST 'https://api.fitsociety.io/public/v1/make/accounting/webhooks' -H 'Authorization: Bearer <make_accounting_access_token>' -H 'Idempotency-Key: accounting-enable-001' -H 'Content-Type: application/json' -d '{"event":"invoice.created","url":"https://hook.eu1.make.com/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({event: 'invoice.created', url: '<string>'})
};
fetch('https://api.fitsociety.io/public/v1/make/accounting/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.fitsociety.io/public/v1/make/accounting/webhooks"
payload = {
"event": "invoice.created",
"url": "<string>"
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"id": "66f7b8b1e13c8d25f4d3d90a",
"companyId": "66f7b8b1e13c8d25f4d3d90a",
"event": "invoice.created",
"signingSecret": "string"
},
"meta": {
"requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
"rateLimit": {
"limit": 10,
"remaining": 9,
"resetSeconds": 1
},
"idempotency": {
"replayed": false
}
}
}Authorizations
Public API access token issued by /public/v1/oauth/token. Example: Authorization: Bearer fspt_.... Each resource request rechecks the token company's current provider access. Disabling access blocks existing tokens with 403 auth.provider_unavailable.
Headers
200