---
title: "`invoice.sent`"
method: POST
path: "invoice.sent"
---

# \`invoice.sent\`

`POST invoice.sent` (webhook)

Sent to every enabled endpoint subscribed to `invoice.sent`.

Verify the `relaw-signature` header before trusting the body.
It is `t=<unix>,v1=<hex>`, where the hex is HMAC-SHA256 of
`<t>.<raw body>` keyed with your endpoint's signing secret.
Reject anything where `t` is more than five minutes from now —
the timestamp is inside the signed material precisely so it
cannot be rewritten to extend a captured request's life.

Respond 2xx to acknowledge. A 5xx is retried; a 4xx is treated
as a permanent refusal and not retried. Endpoints that fail 20
times consecutively are disabled, and the firm is told why.

Retries reuse the same `relaw-event-id`. Deduplicate on it:
delivery is at-least-once, not exactly-once.

## Payload

- object
  - `id` string, uuid, required: Stable across retries. Your deduplication key.
  - `type` 'invoice.sent', required
  - `createdAt` string, date-time, required: When the event happened, not when it was sent. These differ on a retry.
  - `data` object, required

## Acknowledgement `2XX`

Acknowledged; not retried.

## Other responses

- `4XX`: Permanent refusal; not retried.
- `5XX`: Transient failure; retried.

---

[API](https://skmtc.dev/relaw/apis/relaw-api.md) - [All operations](https://skmtc.dev/relaw/apis/relaw-api/llms.txt) - [OpenAPI document](https://skmtc.dev/relaw/apis/relaw-api/revisions/51a8e71983e0?raw)