Fetch Webhooks
curl --request GET \
--url https://secureapi.tender.cash/v1/api/webhook \
--header 'authorization: <api-key>' \
--header 'x-access-id: <x-access-id>' \
--header 'x-request-id: <x-request-id>' \
--header 'x-timestamp: <x-timestamp>'const options = {
method: 'GET',
headers: {
authorization: '<api-key>',
'x-timestamp': '<x-timestamp>',
'x-request-id': '<x-request-id>',
'x-access-id': '<x-access-id>'
}
};
fetch('https://secureapi.tender.cash/v1/api/webhook', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://secureapi.tender.cash/v1/api/webhook"
headers = {
"authorization": "<api-key>",
"x-timestamp": "<x-timestamp>",
"x-request-id": "<x-request-id>",
"x-access-id": "<x-access-id>"
}
response = requests.get(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://secureapi.tender.cash/v1/api/webhook",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"authorization: <api-key>",
"x-access-id: <x-access-id>",
"x-request-id: <x-request-id>",
"x-timestamp: <x-timestamp>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"status": "<string>",
"message": "<string>",
"data": {
"_id": "<string>",
"merchantId": "<string>",
"description": "<string>",
"url": "<string>",
"eventTypes": [
"<string>"
],
"headers": {},
"isActive": true,
"isDeleted": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
}Webhooks
Fetch Webhook
Get active webhook configuration for the merchant
GET
/
v1
/
api
/
webhook
Fetch Webhooks
curl --request GET \
--url https://secureapi.tender.cash/v1/api/webhook \
--header 'authorization: <api-key>' \
--header 'x-access-id: <x-access-id>' \
--header 'x-request-id: <x-request-id>' \
--header 'x-timestamp: <x-timestamp>'const options = {
method: 'GET',
headers: {
authorization: '<api-key>',
'x-timestamp': '<x-timestamp>',
'x-request-id': '<x-request-id>',
'x-access-id': '<x-access-id>'
}
};
fetch('https://secureapi.tender.cash/v1/api/webhook', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://secureapi.tender.cash/v1/api/webhook"
headers = {
"authorization": "<api-key>",
"x-timestamp": "<x-timestamp>",
"x-request-id": "<x-request-id>",
"x-access-id": "<x-access-id>"
}
response = requests.get(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://secureapi.tender.cash/v1/api/webhook",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"authorization: <api-key>",
"x-access-id: <x-access-id>",
"x-request-id: <x-request-id>",
"x-timestamp: <x-timestamp>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"status": "<string>",
"message": "<string>",
"data": {
"_id": "<string>",
"merchantId": "<string>",
"description": "<string>",
"url": "<string>",
"eventTypes": [
"<string>"
],
"headers": {},
"isActive": true,
"isDeleted": true,
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z"
}
}Auth method: Signed (HMAC) — this endpoint requires the full set of signed
headers:
x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256
authorization signature. See Authentication.Headers
string
required
Base64-encoded HMAC-SHA256 signature of the request payload using the API secretMinimum string length:
1Example: "5e73d044c44d733fcf819ad3409aaaddca840d421b69cb0b04e2c750fc62e-ce7526d36296237663ad1f06f62a730c0466516507196b3ce6567493c-c52a7cf63d"string
required
Current timestamp in ISO 8601 formatExample:
"2025-03-15T09:45:53.000Z"string
required
Unique identifier for the request (UUID v4)Example:
"550e8400-e29b-41d4-a716-446655440000"string
required
Your API access ID provided by TenderExample:
"your-access-id-here"Response
string
required
Status of the API requestExample:
"success"string
required
Human-readable message describing the resultExample:
"Webhooks fetched"object
required
The active webhook configuration
Show data properties
Show data properties
string
Unique MongoDB identifier for the webhookExample:
"69105ed34b9f23d52d1be957"string
Merchant ID associated with the webhookExample:
"6538e8f9bdec6d1a21978a64"string
Description of the webhookExample:
"example requests"string
Webhook endpoint URLExample:
"https://example.com"array
Array of subscribed event typesExample:
["transaction_completed"]object
Custom headers for webhook requestsExample:
{ "api-key": "allow-requior" }boolean
Whether the webhook is currently activeExample:
trueboolean
Whether the webhook has been deletedExample:
falsestring
ISO 8601 timestamp when the webhook was createdExample:
"2025-11-09T09:28:51.401Z"string
ISO 8601 timestamp when the webhook was last updatedExample:
"2025-11-09T09:28:51.401Z"number
Version key for MongoDB documentExample:
0Authorizations
Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601), and authorization (Base64 HMAC-SHA256 signature of {timeStamp, requestId, accessId} using your access secret).
Headers
Base64-encoded HMAC-SHA256 signature of the request payload using the API secret
Current timestamp in ISO 8601 format
Unique identifier for the request (UUID v4)
Your API access ID provided by Tender