Pay: webhooks

Create a webhook endpoint

POST/v1/webhook_endpoints

https:// only, checked against private, local and cloud-metadata addresses. The signing secret (whsec_…) is returned once; an idempotent replay returns secret: null. Signature: X-Signature: sha256=HMAC(secret, "{X-Timestamp}.{raw body}"), as for Alerts webhooks. At most 10 active endpoints per environment (webhook_endpoint_limit).

Authentication: API key (Authorization: Bearer)
Required scope: pay:write

Safe to retry with the Idempotency-Key header: see Idempotency.

Headers#

Idempotency-Keystringrequired
Required on every Pay POST; makes it safe to retry for 24 hours. Scoped to the key's environment.

1 to 255 characters

Request body#

urlstringrequired
at most 2048 characters
event_typesarray of string
Empty or absent: all events.

Values invoice.created invoice.confirming invoice.paid invoice.underpaid invoice.overpaid invoice.expired invoice.paid_late invoice.canceled invoice.reverted invoice.held sweep.succeeded sweep.failed refund.succeeded refund.pending merchant.payout_change_requested merchant.payout_changed merchant.frozen merchant.kyb_updated

Responses#

201Endpoint created; secret shown once.

Object fields

idstring · uuid
objectstring
Values webhook_endpoint
environmentstring
Values test live
urlstring
event_typesarray of string
Values invoice.created invoice.confirming invoice.paid invoice.underpaid invoice.overpaid invoice.expired invoice.paid_late invoice.canceled invoice.reverted invoice.held sweep.succeeded sweep.failed refund.succeeded refund.pending merchant.payout_change_requested merchant.payout_changed merchant.frozen merchant.kyb_updated
statusstring
Values enabled disabled
created_atstring · date-time
disabled_atstring · date-timenullable
secretstringnullable

4xx · 5xxError.

Standard error format: see Errors.

Request

cURL

curl -X POST "https://aicscan.io/v1/webhook_endpoints" \
  -H "Authorization: Bearer $AICSCAN_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "url": "string",
    "event_types": [
      "invoice.created"
    ]
  }'

JavaScript

const res = await fetch('https://aicscan.io/v1/webhook_endpoints', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.AICSCAN_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    "url": "string",
    "event_types": [
      "invoice.created"
    ]
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(data.error.code);
console.log(data);

Python

import os, uuid
import requests

resp = requests.post(
    "https://aicscan.io/v1/webhook_endpoints",
    headers={
        "Authorization": f"Bearer {os.environ['AICSCAN_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "url": "string",
        "event_types": [
            "invoice.created"
        ]
    },
    timeout=10,
)
resp.raise_for_status()
print(resp.json())

Response 201

JSON

{
  "id": "0193a1c9-41aa-7b2e-9c0d-1e2f3a4b5c6d",
  "object": "webhook_endpoint",
  "environment": "test",
  "url": "string",
  "event_types": [
    "invoice.created"
  ],
  "status": "enabled",
  "created_at": "2026-11-14T09:30:13Z",
  "disabled_at": "2026-11-14T09:30:13Z",
  "secret": "string"
}