Skip to main content

Webhooks — Reference

Auth: X-API-Key.

POST /v1/webhooks — create​

curl -X POST "$BASE_URL/v1/webhooks" \
  -H "X-API-Key: $THIQWAVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://api.partner.com/webhooks/thiqwave",
    "description": "Production settlement callbacks",
    "events": ["settlement.completed", "settlement.failed"]
  }'

Body: url (https, max 2048), optional description (max 256), events (non-empty array). Response 201 returns the one-time secret plus masked_secret. Max 10 endpoints per application.

Events: settlement.created · settlement.completed · settlement.failed · counterparty.kyb_approved · counterparty.kyb_rejected · on_ramp.completed · off_ramp.completed.

GET /v1/webhooks — list (never returns plaintext secret)​

PATCH /v1/webhooks/:id — update (url, events, status, description)​

DELETE /v1/webhooks/:id — delete (204)​

POST /v1/webhooks/:id/secret/rotate​

Returns a new one-time plaintext secret; old secret invalidated immediately.

Signature verification (verified)​

Each delivery carries X-Thiqwave-Signature: t=<unix_seconds>,v1=<hex_hmac_sha256> where v1 = HMAC_SHA256(secret, "<t>.<raw_body>") in lowercase hex. See the verify snippets in the Webhooks guide.