---
title: "Ikas Webhook"
method: POST
path: "/api/webhooks/ikas"
tags: ["webhooks"]
---

# Ikas Webhook

`POST /api/webhooks/ikas`

## Request

- Base URL: `https://api.heymetra.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.heymetra.com/api/webhooks/ikas`
- Auth: none declared

Everything ikas sends to the app's Webhook URL (ZEISO-951).

Two kinds matter. `store/app/deleted`: the store removed HeyMetra, so its
connections close and both halves of the grant are destroyed. And the
request ikas sends 48 hours later to delete that store's customers'
personal data: HeyMetra keeps none — answers are read live and cached for
at most a minute — so it is acknowledged and recorded. Any other signed
delivery is acknowledged too, because ikas retries a non-200 three times.

The body is `{id, createdAt, scope, merchantId, authorizedAppId, data,
signature}`; `signature` is HMAC-SHA256 of `data` with our client secret.
Unsigned is unanswered: 401, nothing touched.

## Response `200`

Successful Response

- unknown

## Changes

- **2026-10-20** `488ce9683884`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/heymetra/apis/heymetra-api/changes/api/webhooks/ikas/post.md)

---

[API](https://skmtc.dev/heymetra/apis/heymetra-api.md) · [All operations](https://skmtc.dev/heymetra/apis/heymetra-api/llms.txt) · [OpenAPI document](https://skmtc.dev/heymetra/apis/heymetra-api/revisions/877b0f87d6d0?raw)