Get webhook deliveries

curl --request GET \
  --url https://platform.spritz.finance/v1/integrator/webhooks/deliveries \
  --header 'X-Integrator-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>'

import requests

url = "https://platform.spritz.finance/v1/integrator/webhooks/deliveries"

headers = {
    "X-Signature": "<api-key>",
    "X-Integrator-Key": "<api-key>",
    "X-Timestamp": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {
    'X-Signature': '<api-key>',
    'X-Integrator-Key': '<api-key>',
    'X-Timestamp': '<api-key>'
  }
};

fetch('https://platform.spritz.finance/v1/integrator/webhooks/deliveries', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/webhooks/deliveries",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Integrator-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.spritz.finance/v1/integrator/webhooks/deliveries"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("X-Integrator-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://platform.spritz.finance/v1/integrator/webhooks/deliveries")
  .header("X-Signature", "<api-key>")
  .header("X-Integrator-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform.spritz.finance/v1/integrator/webhooks/deliveries")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "event": "onramp.completed",
      "webhookUrl": "https://api.example.com/webhooks",
      "payload": {},
      "success": true,
      "responseStatus": 200,
      "error": "getaddrinfo ENOTFOUND webhooks.example.com",
      "timestamp": "2023-11-07T05:31:56Z"
    }
  ],
  "hasMore": true,
  "nextCursor": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 401,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "Bearer token required",
  "instance": "<string>",
  "realm": "API",
  "scope": "read:users"
}

{
  "title": "<string>",
  "status": 404,
  "resourceType": "user",
  "resourceId": "<string>",
  "type": "about:blank",
  "detail": "<string>",
  "instance": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

Integrator

Get webhook deliveries

Returns recent webhook delivery attempts for the integrator, newest first.

Use this to tell “Spritz never sent it” apart from “my endpoint rejected it” — from the outside both look like silence.

Read error first — it is what separates the two cases.

success: true — your endpoint accepted the delivery, and responseStatus is what it returned.
success: false, no error, with a responseStatus — the request reached your endpoint and it responded with that status. Your handler is being called and is failing.
success: false with neither error nor responseStatus — the outcome was not recorded. Only older records look like this; every delivery the current sender writes carries a status. There is nothing to diagnose from them.
success: false with an error — no usable response came back: a timeout, a refused connection, a DNS or certificate problem. error carries the underlying reason (for example getaddrinfo ENOTFOUND ...). Note that responseStatus is still present here — 504 for a timeout, 500 otherwise — but it is our classification of the failure, not something your endpoint said. Do not read it as your handler’s response.

An error does not prove the event was not processed. A refused connection means it never arrived, but a timeout or a dropped connection may mean your endpoint received and fully handled the event and we simply never heard the answer. Treat these as unknown, not as not delivered — re-running non-idempotent work on the strength of an error is how you double-process. This is the case idempotent handlers exist for.

payload is the exact body that was sent, and the body the Signature header was computed over, so it can be replayed against your own verification code.

Cursor-paginated: pass the previous response’s nextCursor as cursor to walk further back. nextCursor is null on the last page.

Deliveries are recorded for every webhook on the integrator. Scope is your own integrator only.

GET

integrator

webhooks

deliveries

Get webhook deliveries

curl --request GET \
  --url https://platform.spritz.finance/v1/integrator/webhooks/deliveries \
  --header 'X-Integrator-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>'

import requests

url = "https://platform.spritz.finance/v1/integrator/webhooks/deliveries"

headers = {
    "X-Signature": "<api-key>",
    "X-Integrator-Key": "<api-key>",
    "X-Timestamp": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {
    'X-Signature': '<api-key>',
    'X-Integrator-Key': '<api-key>',
    'X-Timestamp': '<api-key>'
  }
};

fetch('https://platform.spritz.finance/v1/integrator/webhooks/deliveries', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/webhooks/deliveries",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-Integrator-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.spritz.finance/v1/integrator/webhooks/deliveries"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("X-Integrator-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://platform.spritz.finance/v1/integrator/webhooks/deliveries")
  .header("X-Signature", "<api-key>")
  .header("X-Integrator-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform.spritz.finance/v1/integrator/webhooks/deliveries")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "event": "onramp.completed",
      "webhookUrl": "https://api.example.com/webhooks",
      "payload": {},
      "success": true,
      "responseStatus": 200,
      "error": "getaddrinfo ENOTFOUND webhooks.example.com",
      "timestamp": "2023-11-07T05:31:56Z"
    }
  ],
  "hasMore": true,
  "nextCursor": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 401,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "Bearer token required",
  "instance": "<string>",
  "realm": "API",
  "scope": "read:users"
}

{
  "title": "<string>",
  "status": 404,
  "resourceType": "user",
  "resourceId": "<string>",
  "type": "about:blank",
  "detail": "<string>",
  "instance": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

Authorizations

X-Signature

string

header

required

HMAC signature authentication for backend integrators.

Required Headers:

X-Integrator-Key: Integrator API key (format: int_...)
X-Signature: HMAC signature (format: sha256={hex})
X-Timestamp: Unix timestamp in milliseconds
Authorization: Bearer {user-api-key}

Signature Algorithm: HMAC-SHA256

Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}

timestamp: Unix timestamp in milliseconds
METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
path: Request path (e.g., /v1/transactions)
bodyHash: SHA256 hex digest of request body (empty string if no body)

Timestamp Tolerance: ±5 minutes (300 seconds)

Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...

X-Integrator-Key

string

header

required

Integrator API key (format: int_...) used with HMAC authentication

X-Timestamp

string

header

required

Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.

Query Parameters

limit

number

default:50

Maximum number of results to return

Required range: 1 <= x <= 100

cursor

string

Opaque cursor from the previous response's nextCursor value

Pattern: ^[a-fA-F\d]{24}$

Response

Response for status 200

data

object[]

required

Recent webhook delivery attempts, newest first

Show child attributes

hasMore

boolean

required

Whether there are more results

Example:

true

nextCursor

string | null

required

Pass as cursor to fetch the next page. Null on the last page.

Auto-Ramp Accounts

Auto-Ramp Addresses

Off-Ramp Quotes

Off-Ramps

On-Ramps

Bank Accounts

Funding Sources

Deposits

Bills

Cards

Debit Cards

Integrator Connect

Integrator

Users

Compliance

Terms

API Keys

Device Authorization

Wallet Kit

Sandbox

Get webhook deliveries

Authorizations

Query Parameters

Response