'/%3e%3cdefs%3e%3cpattern%20id='pattern0_2104_4598'%20patternContentUnits='objectBoundingBox'%20width='1'%20height='1'%3e%3cuse%20xlink:href='%23image0_2104_4598'%20transform='matrix(0.00376176%200%200%200.0172414%20-0.00219436%200)'/%3e%3c/pattern%3e%3cimage%20id='image0_2104_4598'%20width='267'%20height='58'%20preserveAspectRatio='none'%20xlink:href='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQsAAAA6CAMAAACQ2ozcAAAAM1BMVEVMaXH////////////////////////////////////////////////////////////////x7/yuAAAAEHRSTlMAoDDgEPBgwIBAINCwkHBQDIOTDwAAAAlwSFlzAAFxGAABcRgB7MGwCAAABm1JREFUaIHlW+uWsyoMLSIIeH3/pz0CKrmgQuusdn0nf2YaMW42kISgr1cQK+SySj+61/9cmm45RLTfRvNV0WoBIptv4/mi6AWLuiVDd0lKmLPGGPsA0nelGG8TZoXU69poTPi/v1smBjB338dZxvk218B/VIrxBl8hth9t73+Zp2x7SdNuLMX+tJTitZCKjQx1MzFquLBVc+hvpBSv8NMX/Hb+Bv2MbS8DaNsVYn9aSvFK2nWB5slHtr0sUL4Ur0vx+usowdL3A1jBhUVcfGmR1HCBFPbvuWhskvuefC4/wkWbWyMgzV2ub39GarhA+cf0KBevHrTdffSvcuGxonzCA73JBGq4gFnt7qN/lYtxwflEWOA3KWJVriWOpkd0+lUuQj6Rsu6QkcuL9jW2o4xbyzTZfpWLOG79FlatgnP5Y9tRnFn3RAYE7p/loo1bJ6GtnSLIYbuwRrz8rq6SCyY/y8W2UU0SFkw7xQCghszN/y4Xr0ZCKjpPxQz46Vjdj9pupiHUBsxclmRXcOG0CKZHfVV9dHqM1QmRrZNU4IVN15kwQ98fNHSlYNsaUsmmEUw899gNuQCck2ur17KwZXcypM6gsVSCtSN4YcozzLmWqtvbNCPRUDKgbU07RiC/z8XgmOnMtHNiYUJZu8Tbg8YW3B6HOK6PwRPQRo1sT21nBGVq73OxKNaElx8n3iiAR4CL8YbOHlH0YHnXtAL2osg2Gr8PuMgIIaPNTIooqIJdijfkyFO6b6u9gBTDo1M1PKOK6bNcYCBtf9Gwqcc7LHgr1qqFaHil69Y2KAY9zMWe/Ny3BWSU4vVdZ3UtvCHxGuQD7m2nmfY0FyBBGK8bJidXitf/gxbA7DVQwStdBbbVng48zsUxMexdy7EWr/8H9dw/QjJNLRfHKnmci2Pk5G1LW4nX/2U9x5p5eYOLvYj6PBfb+qXHfacWy/H6P6yuhavBfl1Cl0VtK7MaaGcS30wZF6ny2WS4kD71ttjyZgXHEDk5j4Ew2dTh9SbREYCEqA/NBBXY9pHX4E2eLOPiRQT1RsDAv0sc7QZhOHowIwxjHd4wDcDEmCJ1jmjQREG2werBxt3HXKRIwE+cEAYwmMijygze/hxvrq6FNJp0mNp2Zxf0x1ykWD8zLmA7lIChqe+u8U4Eb2goLbjYSaCJdnDqC20jR4JOAMzHXADYjAs4pCj5QYvH3uCFVjy66IR6Y8zoSfDlPr1rhEKdyHCB64GwJ8PHXAA144L3eBcYaw3DixwfW3skqw+GcUpHj1fP60TwSveXXKDRP7fAubjBi2bKwnrAT5p/gAsEEFuA41jNBQ60YZEip8Lq4r/NBexOLRfbvX0XfGZY5i5uVjcNOzs6tz0S23/GhYNctKcWKrmI4Sq+2BlebpRm9FSY8IRYcVTndS3si6DrEX/JBfKdeKjgitcMLw4DxNf7oVcHW/viSLt/kfqV46KHF9BofR5Tr7iA0QKhg6lIJqZe4Q3hExAroJEgIe6c17XgpEOeZy7ighatS7mA0RDlTyiJr8Obr2sJqjmva4H1g7eObREXNEiVcoGeBWqKuXy7FG9kBEhwfyjPZG9wkQOVfJlgS/Bu9+wbyy5z7YoLNL2XfgNMisFTBd6+qH5xW9fqjbV6JLUVfc4FzuS6yVoz3Lyzw7jAi2SlfrWiBTkhaOvwZrnomaa6lrNPxRwX2ft1JRe3Jb40mUvxkmc+Vtcy0NyFjgIv5oJOjEz39nVXitf/Rb6c+4txufQXWTkqpjkuXrnDLlnLhcsfmSU5Up9SvP7ZvK7F4shFXSsrB5lZLrLHXbzGd80FziS4pN15Kd6QXIGJYUhftolyXtfKSgrBWS5c7p6plguyayJyFmcv8IZRT1nmHnKJ5jzvzAoormS5yFoYqrm4AgI//LjFu3cvkKvioLQp2qlIlQseSuEXQYDt7JqFiVmei+wqqeeCfBIFewcT5XK80R+rwZgNx/F60qEhm3Zgu+HHuxK54hMucmTYei5e7B2NCD37hknAy9tDvPS0WjDNef1iTUQMploZvKc942L/3Aj0sXmDi9UOGw0KoQovzAPD2miRhr35mr7fCo3BO0K9pq/ONOBbL03NpIfIcXNQI2gP2gIteym5gSmkGvgbmRd4J/aqj93zFiUc1VCSc+K0WWWytd+HtHZ678YTQ2Yu+4jSzVePbcNVe6n51+U/wZKesx3N5aEAAAAASUVORK5CYII='/%3e%3c/defs%3e%3c/svg%3e)
Overview
Webhook endpoints are HTTPS URLs Bitnob Enterprise POSTs event payloads to. Register a webhook, choose which event types it receives, and verify each delivery with its signing secret. Individual delivery attempts are tracked as Events — use those to audit and retry failed deliveries.
List Webhooks
Use Case
Returns all webhook endpoints registered for the organization.
Webhook Fields
Always `webhook`.
Stable identifier for the webhook. Pass it to the get, update, delete, and rotate-secret endpoints, and as `webhook_id` on the Events endpoints.
HTTPS URL deliveries are POSTed to.
The event type (or types) this webhook is subscribed to.
Lifecycle state: `active` (delivering) or `inactive` (soft-deleted).
Last 4 characters of the signing secret, for at-a-glance identification. The full secret is only returned on create and rotate.
RFC 3339 timestamp of when the webhook was created.
RFC 3339 timestamp of the most recent update.
Create Webhook
Use Case
Registers a new webhook endpoint for event delivery. The response includes the signing secret once — store it before the response closes; it can be rotated but never retrieved again.
Request Body
HTTPS URL deliveries will be POSTed to. Must answer `2xx` within the delivery timeout or the event is retried with backoff.
Event types this webhook should receive (e.g. `transaction.completed`, `wallet.created`). Omit to receive all event types.
Create Webhook Response
The full signing_secret is returned only on this response. Store it immediately — subsequent reads only expose signing_secret_last4. Use it to verify the signature header on every delivery.
The response carries the same webhook fields as List Webhooks, plus the plaintext signing_secret.
Get Webhook
Use Case
Returns a single webhook endpoint by ID.
Path Parameters
The webhook to retrieve.
The response is a single webhook object — same field shape as each entry in List Webhooks. The full signing secret is never returned here, only signing_secret_last4.
Update Webhook
Use Case
Updates a webhook endpoint's URL. The signing secret is unchanged — use [Rotate Signing Secret](#Rotate Signing Secret) if you need a new one.
Request Body
Replacement HTTPS delivery URL. Future events are POSTed here instead of the previous URL.
Returns the updated webhook object — same field shape as Get Webhook, with a fresh updated_at.
Delete Webhook
Use Case
Soft-deletes a webhook. Pending deliveries are cancelled and the webhook stops receiving events.
Path Parameters
The webhook to delete.
Returns HTTP 200 on success. The webhook's status flips to inactive; historical events remain queryable for audit.
Rotate Signing Secret
Use Case
Generates a new signing secret for the webhook. The new secret is returned once; the previous secret stops verifying deliveries immediately.
Path Parameters
The webhook whose secret to rotate.
The new signing_secret is returned only on this response. Store it before the response closes — the old secret stops verifying signatures the instant the rotation completes.