AFafriex
Webhooks

Payment Method Events

Afriex delivers real-time notifications to your configured webhook URL whenever a payment method is created, updated, or deleted for a customer.

A call to GET /api/v1/payment-method/pool-account also sends PAYMENT_METHOD.UPDATED for the pool account, on every call.

The payload structure is identical across all events. Only the event field changes.

Security: Every request includes an x-webhook-signature header and an x-afriex-business-id header carrying your business id. You must verify this signature using Afriex's public key before processing. The key is an elliptic-curve (secp384r1 / P-384) key, not RSA. The signature is ECDSA with SHA-256, DER-encoded and then base64-encoded, computed over the exact raw request body, so verify it before parsing or re-serialising the JSON. See the Webhooks Overview & Security section for verification instructions.

postWebhookpayment_method.events

Payload

idstring uuid required

Unique ID of this event. Every delivery attempt of the same event carries the same id, so use it to ignore a delivery you have already processed.

event'PAYMENT_METHOD.CREATED' | 'PAYMENT_METHOD.UPDATED' | 'PAYMENT_METHOD.DELETED' required

Identifies which payment method event occurred

createdAtstring date-time required

When Afriex created the event. Retries keep this value, and the signature covers it, so you can reject a delivery that is older than you expect.

Example payload

{
  "id": "8f14e45f-ceea-4e7a-9f1d-6b1c2a3d4e5f",
  "event": "PAYMENT_METHOD.UPDATED",
  "createdAt": "2026-04-24T09:13:33.883Z"
}

Response

Acknowledge receipt. Return any 2xx status code quickly. Response body is ignored.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.