/api/v1/webhooks webhooks:manage Registers a webhook URL for the event types you choose. The signing secret is returned ONCE, so store it. Private/internal URLs are rejected. Verify each delivery with HMAC_SHA256(secret, "<timestamp>.<raw_body>") against the X-Mystery-Signature header, dedupe on X-Mystery-Delivery, and reject anything older than ~5 minutes.
POST /api/v1/webhooks write These inputs are shared across all docs pages, so an id entered here carries over.
{
"url": "https://example.com/cardos-webhook",
"event_types": [
"deposit.credited",
"purchase.submitted",
"purchase.fulfilled",
"purchase.refunded",
"purchase.failed",
"sellback.confirmed",
"payout.statement_ready",
"payout.paid",
"redemption.prepared",
"redemption.updated"
]
}Not run yet. Press Run to make a live call against https://service.rip.fun (through this demo's server-side proxy; the API key never reaches the browser).
curl -X POST 'https://service.rip.fun/api/v1/webhooks' \
-H 'X-API-Key: rip_…' \
-H 'Content-Type: application/json' \
-d '{"url":"https://example.com/cardos-webhook","event_types":["deposit.credited","purchase.submitted","purchase.fulfilled","purchase.refunded","purchase.failed","sellback.confirmed","payout.statement_ready","payout.paid","redemption.prepared","redemption.updated"]}' | Field | Type | Required | Description |
|---|---|---|---|
url | string | yes | Public HTTPS endpoint (private/internal addresses rejected) |
event_types | string[] | — | deposit.credited, purchase.reserved/submitted/fulfilled/refunded/failed, instant_purchase.reserved/submitted/fulfilled/refunded/failed, buyback.confirmed/transfer_held/card_transferred/transfer_failed, redemption.prepared/updated, pool.item_pulled, sellback.confirmed, payout.statement_ready, payout.paid. Omit for all |
data)| Field | Description |
|---|---|
id / url / event_types / is_active | The registered webhook |
signing_secret | 64-hex HMAC secret, shown ONCE, so store it now |
| Status | Code | When |
|---|---|---|
| 409 | webhook_limit | more than 20 webhooks registered |
See Errors for the response envelope and the full code list.