Skip to main content
POST
curl

Authorizations

API-Key
string
header
required

Your public API key. Identifies the partner making the request.

API-Nonce
string
header
required

Monotonically increasing nonce included in the request signature.

API-Sign
string
header
required

HMAC signature over the request, computed with your private key.

Headers

Idempotency-Key
string<uuid>

Client-generated UUIDv4 for safe retries. Sent as the Idempotency-Key HTTP header. Replayed responses include the Idempotent-Replayed: true header.

Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
Example:

"550e8400-e29b-41d4-a716-446655440000"

Body

application/json
url
string<uri>
required

The HTTPS URL where webhook events will be sent. This endpoint must be publicly accessible and respond to POST requests.

Maximum string length: 2048
Example:

"https://your-domain.com/webhooks/payward"

events
enum<string>[]
required

List of event types to subscribe to. At least one event is required.

Required array length: 1 - 100 elements
Available options:
quote.executed,
quote.cancelled,
quote.execution_failed,
user.closed,
user.disabled,
user.verified,
user.verification_failed,
user.verification_needed,
conversion.deposit_completed,
conversion.deposit_failed,
conversion.deposit_held,
conversion.quote_execution_failed,
conversion.withdrawal_completed,
conversion.withdrawal_failed
Example:
description
string

Optional free-form label for the webhook.

Maximum string length: 500
Example:

"primary delivery"

disabled
boolean
default:false

Create the webhook in a disabled state. Defaults to false.

Example:

false

Response

Webhook registered successfully

data
object
required