Skip to navigation
Endpoints

offer.updated

Triggered when an offer is accepted or rejected

Headers

webhook-idstringRequired

Message ID (msg_…), the same on every retry of this message. Use it to skip duplicates.

webhook-timestampstringRequired
Unix time the message was signed. Reject messages more than 5 minutes old.
webhook-signaturestringRequired

v1,<base64 HMAC-SHA256> of {webhook-id}.{webhook-timestamp}.{raw body}, keyed with the base64-decoded part of your signing secret after whsec_. Several signatures may be space-separated during a secret rotation; accept the message if any one matches.

Payload

The payload of this webhook request is an object.
idstringRequired

Message ID; equals the webhook-id header

type"offer.updated"Required
timestampdatetimeRequired
dataobjectRequired

v1 offer response - wraps domain OfferRead with prefixed IDs.

Response

2XX
Acknowledges the delivery.
4XX

Final: the message is not retried. This covers 400, 401, 403, 404 and every other 4xx except 408 and 429, which are retried like a 5xx.

5XX

Retried. So are 408, 429, a redirect, no response within 15 seconds, and a connection error: 8 attempts in all over about 28 hours, waiting 5 s, 5 min, 30 min, 2 h, 5 h, 10 h, 10 h between them (each ±20%). After the last attempt the message is sent again only if you replay it.