Resource subscriptions require the
view_sales scope. Each subscription is tied to a specific OAuth application.Available Resources
You can subscribe to the following resource types:sale- New sale completedrefund- Sale refundedcancellation- Subscription cancelled by customersubscription_ended- Subscription ended (all billing cycles complete)subscription_restarted- Cancelled subscription restartedsubscription_updated- Subscription plan or payment method updateddispute- Payment dispute openeddispute_won- Payment dispute resolved in your favor
List Resource Subscriptions
Retrieve all active resource subscriptions for a specific resource type.Query Parameters
string
required
The resource type to filter by. Must be one of:
sale, refund, cancellation, subscription_ended, subscription_restarted, subscription_updated, dispute, dispute_wonResponse
boolean
Whether the request was successful
array
Array of resource subscription objects
Create Resource Subscription
Subscribe to webhook notifications for a specific resource type.Body Parameters
string
required
The resource type to subscribe to. Must be one of:
sale, refund, cancellation, subscription_ended, subscription_restarted, subscription_updated, dispute, dispute_wonstring
required
The webhook URL where notifications will be sent. Must be a valid HTTPS or HTTP URL. Cannot use localhost, 127.0.0.1, or 0.0.0.0.
Response
boolean
Whether the request was successful
object
The created resource subscription object
Delete Resource Subscription
Unsubscribe from webhook notifications.Path Parameters
string
required
The unique identifier of the resource subscription to delete
Response
boolean
Whether the request was successful
Webhook Payload
When an event occurs, Gumroad will send a POST request to yourpost_url with the following structure:
string
Your Gumroad user ID
string
The product ID related to the event
string
The name of the product
string
The product permalink
string
The full product URL
string
The unique sale ID
string
ISO 8601 timestamp of the sale
Additional fields vary by resource type and match the sale object structure
Example Webhook Payload
Webhook Security
Gumroad webhooks are secured in the following ways:- HTTPS: Use HTTPS URLs when possible to encrypt webhook data in transit
- Verification: Verify webhook requests by making a GET request to the sale API endpoint to confirm the sale exists
- IP Allowlisting: Consider allowlisting Gumroad’s IP addresses if your firewall supports it
Testing Webhooks
To test your webhook integration:- Create a resource subscription pointing to your test URL
- Make a test purchase using a test payment method
- Verify your endpoint receives the webhook POST request
- Return a 200 status code to acknowledge receipt
Gumroad will retry failed webhook deliveries with exponential backoff. If your endpoint consistently fails to respond with a 2xx status code, the subscription may be automatically disabled.
Error Codes
Bad Request - Invalid
post_url (must be valid HTTP/HTTPS URL, cannot be localhost/127.0.0.1/0.0.0.0) or invalid resource_nameUnauthorized - Invalid or missing access token
Forbidden - Insufficient permissions (requires
view_sales scope)Not Found - Resource subscription not found or doesn’t belong to your OAuth application
Unprocessable Entity - Unable to create subscription with the provided parameters