> For the complete documentation index, see [llms.txt](https://docs.omni.integratedcommerce.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.omni.integratedcommerce.io/webhooks/legacy/configuration.md).

# Configuring endpoints

Legacy endpoints are configured by Fiska support. What to send, how the shared secret is handled, and what your endpoint must do.

Legacy endpoints are configured by Fiska support on your behalf. To add, change, or remove one, contact <support@integratedcommerce.io> with:

* The endpoint URL (HTTPS)
* The event types it should receive - see the [event catalog](/webhooks/events.md)

Support will provide the **shared secret** used to sign deliveries to that endpoint. It is provided out-of-band, and there is no portal in which to view or rotate it - to rotate, contact support.

{% hint style="danger" %}
Treat the shared secret exactly as you treat your API key: store it in a secrets manager, never in source control, never in client-side code, and never in a log line. It is the only thing standing between your handler and a forged event.
{% endhint %}

## Choosing subscriptions per endpoint

Each event type is separate, and each endpoint independently chooses which types it subscribes to. Subscribe only to what you handle.

A common pattern is one endpoint per concern: one for transaction events feeding your order system, another for token events feeding your stored-card records.

## Retries and replays

Failed deliveries are retried, but there is no published schedule and no self-service way to inspect or replay them. If you believe you missed an event, [`GET /transactions`](/payments/transaction-retrieval.md) gives you the current state directly, and support can investigate delivery outcomes.

## Requirements for your endpoint

* Reachable over HTTPS from the public internet
* Returns a `2xx` promptly - do slow work asynchronously
* Idempotent, because retries mean an event can arrive more than once; [deduplicate on `event.id`](/webhooks/webhooks.md#deduplicate-on-event-id)
* Verifies the checksum before doing anything else

{% hint style="info" %}
If you need to reconcile without waiting for support, [`GET /transactions`](/payments/transaction-retrieval.md) gives you the current state of any transaction directly.
{% endhint %}

## Next steps

* [Verifying the checksum](/webhooks/legacy/verifying-the-checksum.md)
* [Event catalog](/webhooks/events.md)