Webhook access is checked twice. A staff member or app can subscribe only to events allowed by their store permission or Store API scope. When an event is delivered, Tringify also applies the definition's ownership and access settings to each subscriber.
Merchant-owned definitions can be delivered to subscribed store endpoints and appropriately scoped apps. An app always receives events for definitions it owns. Another app receives an app-owned definition only when App access is Shared and that app has the event's required scope.
Merchant access controls store webhook endpoints independently. Read or Read and write allows subscribed store endpoints to receive the value. Hidden prevents delivery to store endpoints. A private app definition is restricted to its owning app even when another app subscribes to the same event.