Pay : webhooks

Créer un point de réception

POST/v1/webhook_endpoints

https:// uniquement, contrôlée contre les adresses privées, locales et de métadonnées du nuage. Le secret de signature (whsec_…) n’est renvoyé qu’une fois ; un rejeu idempotent renvoie secret: null. Signature : X-Signature: sha256=HMAC(secret, "{X-Timestamp}.{corps brut}"), comme pour les webhooks d’Alerts. 10 points actifs au plus par environnement (webhook_endpoint_limit).

Authentification: Clé d’API (Authorization: Bearer)
Portée requise: pay:write

Rejouable sans risque avec l’en-tête Idempotency-Key : voir Idempotence.

En-têtes#

Idempotency-Keystringobligatoire
Obligatoire sur tous les POST Pay ; rend la requête rejouable sans risque pendant 24 heures. Cloisonné par environnement de la clé.

de 1 à 255 caractères

Corps de la requête#

urlstringobligatoire
au plus 2048 caractères
event_typestableau de string
Vide ou absent : tous les événements.

Valeurs invoice.created invoice.confirming invoice.paid invoice.underpaid invoice.overpaid invoice.expired invoice.paid_late invoice.canceled invoice.reverted invoice.held sweep.succeeded sweep.failed refund.succeeded refund.pending merchant.payout_change_requested merchant.payout_changed merchant.frozen merchant.kyb_updated

Réponses#

201Point créé ; secret montré une seule fois.

Champs de l’objet

idstring · uuid
objectstring
Valeurs webhook_endpoint
environmentstring
Valeurs test live
urlstring
event_typestableau de string
Valeurs invoice.created invoice.confirming invoice.paid invoice.underpaid invoice.overpaid invoice.expired invoice.paid_late invoice.canceled invoice.reverted invoice.held sweep.succeeded sweep.failed refund.succeeded refund.pending merchant.payout_change_requested merchant.payout_changed merchant.frozen merchant.kyb_updated
statusstring
Valeurs enabled disabled
created_atstring · date-time
disabled_atstring · date-timepeut valoir null
secretstringpeut valoir null

4xx · 5xxErreur.

Erreur au format standard : voir Erreurs.

Requête

cURL

curl -X POST "https://aicscan.io/v1/webhook_endpoints" \
  -H "Authorization: Bearer $AICSCAN_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "url": "string",
    "event_types": [
      "invoice.created"
    ]
  }'

JavaScript

const res = await fetch('https://aicscan.io/v1/webhook_endpoints', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.AICSCAN_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    "url": "string",
    "event_types": [
      "invoice.created"
    ]
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(data.error.code);
console.log(data);

Python

import os, uuid
import requests

resp = requests.post(
    "https://aicscan.io/v1/webhook_endpoints",
    headers={
        "Authorization": f"Bearer {os.environ['AICSCAN_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "url": "string",
        "event_types": [
            "invoice.created"
        ]
    },
    timeout=10,
)
resp.raise_for_status()
print(resp.json())

Réponse 201

JSON

{
  "id": "0193a1c9-41aa-7b2e-9c0d-1e2f3a4b5c6d",
  "object": "webhook_endpoint",
  "environment": "test",
  "url": "string",
  "event_types": [
    "invoice.created"
  ],
  "status": "enabled",
  "created_at": "2026-11-14T09:30:13Z",
  "disabled_at": "2026-11-14T09:30:13Z",
  "secret": "string"
}