Tenant API - Payment Webhooks

Add a new webhook definition

This endpoint is used to add a new webhook definition.

A partner is allowed to define more than one webhook. It's up to the partner themselves to make sure not to create duplicate definitions. If they do, they will receive duplicate webhooks for the same payments.

A webhook definition essentially consists of a destination URL, and four fields defining a filter for which payments should be reported on. The fields are:

  • cid_filter: The client id of the partner who sent the invoice the payment was based on to Kivra. Can be a key or the special value *, which means all keys. This value is not possible to set via this API, since it would allow leaking information between partners. If you need to receive webhooks for payments based on invoices sent by another partner, contact Kivra.

  • tkey_filter: The tenant key for the actual sender of the invoice the payment was based on. This may be the same entity as the sending client, but very often is not. This key may also be set to the special value *, in which case webhooks will be delivered for all invoiced sent by the given client id, no matter which tenant they were sent on behalf of. It is never allowed for both this key and cid_filter to be set to *, since that would mean reporting on absolutely every payment made through Kivra.

  • types: A list consisting with strings representing the types of payments webhooks should be delivered for. Currently available are instant (Swish), bank and autogiro.

  • events: A list of the events concerning a payment that a webhook should be delivered for. Currently available are scheduled, settled, failed and declined.

Not all events apply to all types. Currently, the exhaustive list of events for each type is:

  • instant_payment_settled
  • instant_payment_failed
  • bank_payment_settled
  • bank_payment_scheduled
  • bank_payment_failed
  • autogiro_payment_settled
  • autogiro_payment_scheduled
  • autogiro_payment_failed
  • invoice_declined

invoice_declined is a special event which currently only applies to content with the type invoice.renewal or invoice.donation. Regular invoices, i.e. with type invoice, can not be declined in Kivra.

The receiving system must respond to Kivra's POST request with a 2xx HTTP response code, and the response must come within one second of the connection being established.

If the POST request is not successfully delivered, Kivra will retry up to ten times at increasing intervals following the recommended timetable from Standard Webhooks. If the delivery still has not succeeded when those attempts are down, the delivery attempt will be discarded.

post/v2/webhooks/payments

Request

  • Base URL: https://sender.api.kivra.com
  • URL: https://sender.api.kivra.com/v2/webhooks/payments
  • Auth: none declared

Request body

urlstring url

The URL to which Kivra will try to deliver the webhook payloads. Must not be in a reserved domain, must have at least one IPv4 address and must not have any IPv4 addresses in a reserved range. The URL scheme must be HTTPS.

cid_filterstring

The client key of the party that made the API call to send the invoice the payment was based on to Kivra.

tkey_filterstring

The tenant key of the sender of the invoice the payment was based on.

typesstring[]

A list of the types of payments that the tenant wants to receive webhooks for.

eventsstring[]

A list of the payment lifecycle events that the tenant wants to receive webhooks for.

Response

The definition of the just-created webhook.

idstring uuid

The ID of the current webhook definition.

urlstring url

The target URL that Kivra will try to deliver to. The hostname in the URL must not be in a restricted domain (like for example example.org or local). The hostname also must resolve to at least one IPv4 address, and must not resolve to any addresses in an IPv4 range reserved by IANA.

cid_filterstring

The client key filter for this webhook configuration.

tkey_filterstring

The tenant key filter for this webhook cofiguration.

typesstring[]

A list of the types of payments that should trigger webhooks.

eventsstring[]

A list of the payment events that should trigger webhooks. Not all events are meaningful for all payment types.

secretstring base64

The newly created secret after a webhook definition was added or modified. The secret is a 256-bit random number that will be used to sign webhook payloads from Kivra. If a secret already exists when a new one is added (that is, when a webhook definition is modified rather han created), payloads will be signed with both the existing and the new secrets for the next 72 hours. For security reasons, this field will be missing in reponses to API calls that do not result in the creation of a new secret.

created_atstring date-time

The time when this definition was created.

Changes

No recorded changes to this operation across all 1 revision of this API.