ALalfredpay
Webhooks

Register a webhook endpoint

Changed on

A prerequisite for every flow, and a step in none of them. Each sequence has at least one point where the next call is only correct after an event arrives.

Store the secret when it comes back. Rotation issues a second secret with an overlap window, so nothing is unverifiable mid-rotation.

Delivery, retries, signature verification and what your endpoint must do are all in Webhooks and events.

post/v1/webhook_endpoints

Request

  • Base URL
    https://api.sandbox.alfredpay.io
  • URL
    https://api.sandbox.alfredpay.io/v1/webhook_endpoints
  • Auth
    • HTTP bearer
    • or API key in header api-key and API key in header api-secret

Headers

Idempotency-Keystring uuid required

Required on every state-changing POST, simulators included; the only exempt POST is …/verifications/preflight. Replay (same key, same body) returns the original response with Idempotent-Replayed: true; same key with a different body → 409 idempotency_conflict. Keys are UUIDs, scoped to the API key, retained for 24 hours.

Request body

urlstring uri required
event_typesstring[] required

Example request

{
  "event_types": [
    "customer.*",
    "deposit.*",
    "deposit_intent.*",
    "virtual_account.*",
    "conversion.*",
    "payout.*",
    "linked_account.*",
    "rfi.*"
  ]
}

Response

Created

idstring
urlstring uri
event_typesstring[]
secretstring

Returned once, on creation.

status'active' | 'disabled'
createdAtstring date-time

Changes