Webhooks

order.updated

An order changed status or progress. Signed with Spoofy-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>.<body>")>, the event id in Spoofy-Event-Id (until 2026-11-18, also under the header names used before 2026-10-18). Answer 2xx within 10 s; anything else is retried with backoff for about 24 h.

postWebhookorder.updated

Payload

idstring required

Event id; also in the Spoofy-Event-Id header. Use it to drop duplicates.

type'order.updated' | 'deposit.credited' | 'balance.low' | 'automation.updated' required

createdinteger required

Unix seconds.

dataobject required

Response

Received.

Changes

Webhooks have no change history: a webhook is keyed by its event name rather than a path and method, so no recorded change can name it.