Register webhook

POST /api/v1/webhooks webhooks:manage

Registers a webhook URL for event types. The HMAC signing secret is returned ONCE — store it. URLs resolving to private/internal addresses are rejected (SSRF guard). Verify deliveries with HMAC_SHA256(secret, "<timestamp>.<raw_body>") against X-Mystery-Signature, dedupe on X-Mystery-Delivery, and reject deliveries older than ~5 minutes.

Try it POST /api/v1/webhooks write

These inputs are shared across all docs pages — an id entered here carries over.

request body
object · 2 keys 
{
  "url": "https://example.com/mystery-webhook",
  "event_types": [
    "purchase.fulfilled",
    "purchase.refunded",
    "buyback.confirmed",
    "buyback.transfer_held",
    "buyback.card_transferred",
    "buyback.transfer_failed",
    "redemption.prepared",
    "redemption.updated"
  ]
}
response

Not run yet — press Run to make a live call against https://staging-service.rip.fun (through this demo's server-side proxy; the API key never reaches the browser).

curl (tracks the inputs above) 
curl -X POST 'https://staging-service.rip.fun/api/v1/webhooks' \
  -H 'X-API-Key: rip_v1_…' \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com/mystery-webhook","event_types":["purchase.fulfilled","purchase.refunded","buyback.confirmed","buyback.transfer_held","buyback.card_transferred","buyback.transfer_failed","redemption.prepared","redemption.updated"]}'

Request fields

FieldTypeRequiredDescription
urlstringyesPublic HTTPS endpoint (private/internal addresses rejected)
event_typesstring[]—deposit.credited, purchase.reserved/submitted/fulfilled/refunded/failed, buyback.confirmed/transfer_held/card_transferred/transfer_failed, redemption.prepared/updated — omit for all

Response fields (data)

FieldDescription
id / url / event_types / is_activeThe registered webhook
signing_secret64-hex HMAC secret — shown ONCE, store it now

Errors

StatusCodeWhen
409webhook_limitmore than 20 webhooks registered

See Errors for the response envelope and the full code list.