Skip to main content
GET
Get webhooks

Authorizations

X-Signature
string
header
required

HMAC signature authentication for backend integrators.

Required Headers:

  • X-Integrator-Key: Integrator API key (format: int_...)
  • X-Signature: HMAC signature (format: sha256={hex})
  • X-Timestamp: Unix timestamp in milliseconds
  • Authorization: Bearer {user-api-key}

Signature Algorithm: HMAC-SHA256

Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}

  • timestamp: Unix timestamp in milliseconds
  • METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
  • path: Request path (e.g., /v1/transactions)
  • bodyHash: SHA256 hex digest of request body (empty string if no body)

Timestamp Tolerance: ±5 minutes (300 seconds)

Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...

X-Integrator-Key
string
header
required

Integrator API key (format: int_...) used with HMAC authentication

X-Timestamp
string
header
required

Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.

Response

List of webhooks configured for the integrator

id
string
required

Unique identifier for the webhook

Example:

"6a749a054c3b8fc5da595d1e"

events
enum<string>[]
required

List of event types this webhook is subscribed to

Available options:
account.created,
account.updated,
account.deleted,
payment.created,
payment.updated,
payment.completed,
payment.refunded,
verification.status.updated,
capabilities.updated,
onramp.created,
onramp.updated,
onramp.completed,
achDebitReturn.created,
achDebitReturn.updated,
*
url
string<uri>
required

URL to which webhook payloads are delivered

Example:

"https://api.example.com/webhooks"

failureCount
number
required

Number of consecutive delivery failures

Required range: x >= 0
Example:

0

disabled
boolean
required

Whether the webhook is currently disabled

Example:

false