Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

JWT bearer token. Include as Authorization: Bearer <token>. See the Authentication guide for how to obtain one.

Body

application/json

Body of every webhook delivery. The event metadata sits at the top level and the event object in data. The body is identical on every retry and replay of the same event, and it is the exact content covered by the Webhook-Signature header.

type
enum<string>
required

The specific event type within a resource, sent as the type field of each delivery body.

Available options:
OPERATION_REFUNDED
Example:

"OPERATION_REFUNDED"

resource
enum<string>
required

The resource group an event belongs to, sent as the resource field of each delivery body.

Available options:
OPERATION
Example:

"OPERATION"

customerId
string
required

Identifier of the customer the event belongs to.

Example:

"11111111-1111-1111-1111-111111111111"

timestamp
string<date-time>
required

When the event happened, in ISO 8601 UTC. Fixed for the event: retries and replays carry the same value. The time of each delivery attempt is the Webhook-Timestamp header.

Example:

"2026-11-10T14:32:11Z"

data
object
required

Payload delivered for every operation lifecycle event — OPERATION_REQUESTED, OPERATION_PROCESSING, OPERATION_ACTION_REQUIRED, OPERATION_COMPLETED, OPERATION_FAILED, OPERATION_REFUNDING and OPERATION_REFUNDED. The seven carry the same shape; inspect the body's type field — or currentState.status in data — to tell which transition fired.

Response

200

Acknowledged. Trace Finance considers any 2xx response a successful delivery.