curl -X POST 'https://api.fitsociety.io/public/v1/zapier/accounting/webhooks' -H 'Authorization: Bearer <zapier_accounting_access_token>' -H 'Idempotency-Key: accounting-enable-001' -H 'Content-Type: application/json' -d '{"event":"invoice.created","url":"https://hooks.zapier.com/hooks/catch/123/abc/"}'const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({event: 'invoice.created', url: '<string>'})
};
fetch('https://api.fitsociety.io/public/v1/zapier/accounting/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.fitsociety.io/public/v1/zapier/accounting/webhooks"
payload = {
"event": "invoice.created",
"url": "<string>"
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"id": "66f7b8b1e13c8d25f4d3d90a",
"companyId": "66f7b8b1e13c8d25f4d3d90a",
"event": "invoice.created",
"signingSecret": "string"
},
"meta": {
"requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
"rateLimit": {
"limit": 10,
"remaining": 9,
"resetSeconds": 1
},
"idempotency": {
"replayed": false
}
}
}Subscribe a Zapier accounting trigger
Requires finance_invoice_webhooks:write and an Idempotency-Key header. Requires an active Zapier OAuth grant, attributed company administrator consent and Zapier access for the company. The token and current grant must both contain the required scope. These accounting scopes do not require health-data or private-communication consent. Existing connections need a new explicit authorization to gain the accounting scopes. Public API rate limits and the Retry-After response header apply. Only invoice.created is supported, covering Invoice and CreditNote documents. Only HTTPS callbacks on hooks.zapier.com or the exact zapier.com/hooks/standard// callback path are accepted, without credentials, custom ports or fragments. Repeating the same grant and active callback returns its subscription and signing secret; each Zap can use its own callback. Store data.signingSecret securely for signature verification and never map it into module output. Outbound requests retain the signed JSON envelope ; invoice references are flat fields data.invoiceId and data.invoiceType. Verify HMAC-SHA256 over timestamp, delivery ID, event ID and recursively sorted JSON using the returned per-subscription signingSecret. The secret binds the owning company in data.companyId from this subscription response; any company reference present in an event must match it. Filter Invoice or CreditNote only after signature verification. A new enable cycle after deletion requires a fresh Idempotency-Key.
curl -X POST 'https://api.fitsociety.io/public/v1/zapier/accounting/webhooks' -H 'Authorization: Bearer <zapier_accounting_access_token>' -H 'Idempotency-Key: accounting-enable-001' -H 'Content-Type: application/json' -d '{"event":"invoice.created","url":"https://hooks.zapier.com/hooks/catch/123/abc/"}'const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({event: 'invoice.created', url: '<string>'})
};
fetch('https://api.fitsociety.io/public/v1/zapier/accounting/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.fitsociety.io/public/v1/zapier/accounting/webhooks"
payload = {
"event": "invoice.created",
"url": "<string>"
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"data": {
"id": "66f7b8b1e13c8d25f4d3d90a",
"companyId": "66f7b8b1e13c8d25f4d3d90a",
"event": "invoice.created",
"signingSecret": "string"
},
"meta": {
"requestId": "4f849d7d-f4f1-45cc-b4b7-3984a3d17f83",
"rateLimit": {
"limit": 10,
"remaining": 9,
"resetSeconds": 1
},
"idempotency": {
"replayed": false
}
}
}Authorizations
Public API access token issued by /public/v1/oauth/token. Example: Authorization: Bearer fspt_.... Each resource request rechecks the token company's current provider access. Disabling access blocks existing tokens with 403 auth.provider_unavailable.
Headers
200