Skip to main content
POST
Add Webhook
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.

Headers

string
required
Base64-encoded HMAC-SHA256 signature of the request payload using the API secretMinimum string length: 1Example: "5e73d044c44d733fcf819ad3409aaaddca840d421b69cb0b04e2c750fc62e-ce7526d36296237663ad1f06f62a730c0466516507196b3ce6567493c-c52a7cf63d"
string
required
Current timestamp in ISO 8601 formatExample: "2025-03-15T09:45:53.000Z"
string
required
Unique identifier for the request (UUID v4)Example: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access ID provided by TenderExample: "your-access-id-here"
string
required
Media type of the request bodyExample: "application/json"

Body

string
required
Webhook endpoint URL to receive event notificationsExample: "https://example.com/webhook"
string
Description of the webhook purposeExample: "Transaction notifications"
array
required
Array of event types to subscribe toExample: ["transaction_completed"]
object
Custom headers to include in webhook requests (optional)Example: { "api-key": "your-api-key" }

Response

string
required
Status of the API requestExample: "success"
string
required
Human-readable message describing the resultExample: "success"
object
required
The created webhook configuration

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601), and authorization (Base64 HMAC-SHA256 signature of {timeStamp, requestId, accessId} using your access secret).

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of the request payload using the API secret

x-timestamp
string<date-time>
required

Current timestamp in ISO 8601 format

x-request-id
string<uuid>
required

Unique identifier for the request (UUID v4)

x-access-id
string
required

Your API access ID provided by Tender

Content-Type
string
required

Media type of the request body

Body

application/json
url
string<uri>
required

Webhook endpoint URL

Example:

"https://example.com"

eventTypes
string[]
required

Event types to subscribe to

Example:
description
string

Description of the webhook

Example:

"Transaction notifications"

headers
object

Custom headers to include in webhook requests

Example:

Response

200 - application/json

Webhook created successfully

status
string
message
string
data
object