Skip to main content
DELETE
Delete Webhook
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
Rate limit: 120 requests per minute for all webhook endpoints. See Rate limits.

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access ID provided by TenderExample: "your-access-id-here"
Deleting is permanent. Tender stops sending events straight away, and Fetch Webhook returns 406 until you register a new one. Your existing webhook logs are kept.

Path Parameters

string
required
The webhook _id, from Fetch Webhook or Add WebhookExample: "691069ff947a702cfad9e861"

Response

Returns HTTP 200.
string
required
Always "success"
string
required
Example: "success"
object
required

Errors

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required

Your API access ID provided by Tender

Path Parameters

id
string
required

The webhook _id

Response

Webhook deleted

status
enum<string>
required
Available options:
success
message
string
required
data
object
required