List Webhook Events
curl --request GET \
--url https://secureapi.tender.cash/v1/api/webhook/events \
--header 'authorization: <api-key>' \
--header 'x-access-id: <x-access-id>' \
--header 'x-request-id: <x-request-id>' \
--header 'x-timestamp: <x-timestamp>'const options = {
method: 'GET',
headers: {
authorization: '<api-key>',
'x-timestamp': '<x-timestamp>',
'x-request-id': '<x-request-id>',
'x-access-id': '<x-access-id>'
}
};
fetch('https://secureapi.tender.cash/v1/api/webhook/events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://secureapi.tender.cash/v1/api/webhook/events"
headers = {
"authorization": "<api-key>",
"x-timestamp": "<x-timestamp>",
"x-request-id": "<x-request-id>",
"x-access-id": "<x-access-id>"
}
response = requests.get(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://secureapi.tender.cash/v1/api/webhook/events",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"authorization: <api-key>",
"x-access-id: <x-access-id>",
"x-request-id: <x-request-id>",
"x-timestamp: <x-timestamp>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"status": "success",
"message": "Webhook events fetched",
"data": [
"transaction_completed",
"transaction_overpayment",
"transaction_partially_paid",
"transaction_partial_fulfilled",
"transaction_requested",
"transaction_reserved",
"transaction_cancelled",
"sub_user_wallet_transaction_detected",
"sub_user_wallet_transfer_confirmed",
"sub_user_wallet_transfer_failed",
"offramp_order_completed",
"offramp_order_cancelled",
"offramp_order_failed"
]
}
Webhooks
List Webhook Events
Get the names of the webhook events you can subscribe to
GET
/
v1
/
api
/
webhook
/
events
List Webhook Events
curl --request GET \
--url https://secureapi.tender.cash/v1/api/webhook/events \
--header 'authorization: <api-key>' \
--header 'x-access-id: <x-access-id>' \
--header 'x-request-id: <x-request-id>' \
--header 'x-timestamp: <x-timestamp>'const options = {
method: 'GET',
headers: {
authorization: '<api-key>',
'x-timestamp': '<x-timestamp>',
'x-request-id': '<x-request-id>',
'x-access-id': '<x-access-id>'
}
};
fetch('https://secureapi.tender.cash/v1/api/webhook/events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://secureapi.tender.cash/v1/api/webhook/events"
headers = {
"authorization": "<api-key>",
"x-timestamp": "<x-timestamp>",
"x-request-id": "<x-request-id>",
"x-access-id": "<x-access-id>"
}
response = requests.get(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://secureapi.tender.cash/v1/api/webhook/events",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"authorization: <api-key>",
"x-access-id: <x-access-id>",
"x-request-id: <x-request-id>",
"x-timestamp: <x-timestamp>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"status": "success",
"message": "Webhook events fetched",
"data": [
"transaction_completed",
"transaction_overpayment",
"transaction_partially_paid",
"transaction_partial_fulfilled",
"transaction_requested",
"transaction_reserved",
"transaction_cancelled",
"sub_user_wallet_transaction_detected",
"sub_user_wallet_transfer_confirmed",
"sub_user_wallet_transfer_failed",
"offramp_order_completed",
"offramp_order_cancelled",
"offramp_order_failed"
]
}
Auth method: Signed (HMAC) — this endpoint requires the full set of signed
headers:
x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256
authorization signature. See Authentication.Headers
string
required
Base64-encoded HMAC-SHA256 signature of
{"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample:
"2026-10-15T09:45:53.000Z"string
required
A unique UUID v4 per requestExample:
"550e8400-e29b-41d4-a716-446655440000"string
required
Your API access ID provided by TenderExample:
"your-access-id-here"eventTypes when you add a webhook. For when each event fires and its payload, see Webhook Events.
Response
Returns HTTP202 with an array of event names.
string
required
Always
"success"string
required
Example:
"Webhook events fetched"string[]
required
Event names.
transaction_reserved is reserved and not currently sent. New events may be added over time.Example: ["transaction_completed", "transaction_overpayment"]{
"status": "success",
"message": "Webhook events fetched",
"data": [
"transaction_completed",
"transaction_overpayment",
"transaction_partially_paid",
"transaction_partial_fulfilled",
"transaction_requested",
"transaction_reserved",
"transaction_cancelled",
"sub_user_wallet_transaction_detected",
"sub_user_wallet_transfer_confirmed",
"sub_user_wallet_transfer_failed",
"offramp_order_completed",
"offramp_order_cancelled",
"offramp_order_failed"
]
}
Authorizations
Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.
Headers
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.
ISO 8601 timestamp; must be within 5 minutes of server time
A unique UUID v4 per request
Your API access ID provided by Tender
Response
Webhook events fetched
Available options:
success Example:
[
"transaction_completed",
"transaction_overpayment",
"transaction_partially_paid",
"transaction_partial_fulfilled",
"transaction_requested",
"transaction_reserved",
"transaction_cancelled",
"sub_user_wallet_transaction_detected",
"sub_user_wallet_transfer_confirmed",
"sub_user_wallet_transfer_failed",
"offramp_order_completed",
"offramp_order_cancelled",
"offramp_order_failed"
]