Skip to main content
WEBHOOK

Headers

​
x-hypermid-event
enum<string>
required

The event name, so you can route without parsing the body.

Available options:
deposit.failed
​
x-hypermid-signature-v2
string
required

t=<epoch seconds>,v1=<hex hmac>. Carries a second v1= during secret rotation.

​
x-hypermid-signature
string

Legacy bare-hex HMAC over the body alone. No replay protection; prefer the v2 header.

Body

application/json
​
event
enum<string>
required

Event name. Also sent as the x-hypermid-event header so you can route before parsing.

Available options:
checkout.completed,
checkout.expired,
checkout.failed,
deposit.completed,
deposit.expired,
deposit.failed,
withdrawal.completed,
withdrawal.expired,
withdrawal.failed
​
timestamp
integer<int64>
required

Dispatch time, epoch MILLISECONDS. Note this differs from the t= value in x-hypermid-signature-v2, which is epoch SECONDS — sign with the header's value, not this one.

Example:

1755561600000

​
data
object
required

The completed session. Same shape for all three events.

​
test
boolean

Present and true only for a delivery sent by the dashboard's "Test" button, or by POST /v1/payments/webhooks/{webhookId}/test. A real payment never carries it. Reject or sandbox these in production so a test click cannot credit an account.

Example:

true

Response

200 - application/json

Acknowledged. Any 2xx stops retries; anything else — or no response within 10 seconds — is retried, so return this BEFORE doing slow work.

The body is ignored. Returning one is optional.

​
received
boolean

Optional. Nothing reads it — the status code is the whole acknowledgement.