> ## Documentation Index > Fetch the complete documentation index at: https://docs.tender.cash/llms.txt > Use this file to discover all available pages before exploring further. # List Webhook Events > Get the names of the webhook events you can subscribe to > [!NOTE] > > **Auth method: Signed (HMAC)** — this endpoint requires the full set of signed > headers: `x-access-id`, `x-request-id`, `x-timestamp`, and an HMAC-SHA256 > `authorization` signature. See [Authentication](/api-reference/authentication.md#signed-hmac-authentication). Rate limit: 120 requests per minute for all webhook endpoints. See [Rate limits](/api-reference/rate-limits.md). ## Headers **authorization** `string` *required* Base64-encoded HMAC-SHA256 signature of `{"timeStamp":"","requestId":"","accessId":""}`, signed with your access secret. The request body is not part of the signature. **Example:** `"pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="` **x-timestamp** `string` *required* ISO 8601 timestamp; must be within 5 minutes of server time **Example:** `"2026-10-15T09:45:53.000Z"` **x-request-id** `string` *required* A unique UUID v4 per request **Example:** `"550e8400-e29b-41d4-a716-446655440000"` **x-access-id** `string` *required* Your API access ID provided by Tender **Example:** `"your-access-id-here"` Use these names in `eventTypes` when you [add a webhook](/api-reference/endpoint/add-webhook.md). For when each event fires and its payload, see [Webhook Events](/get-started/webhook-events.md). ## Response Returns HTTP **`202`** with an array of event names. **status** `string` *required* Always `"success"` **message** `string` *required* **Example:** `"Webhook events fetched"` **data** `string[]` *required* Event names. `transaction_reserved` is reserved and not currently sent. New events may be added over time. **Example:** `["transaction_completed", "transaction_overpayment"]` ```json 202 theme={null} { "status": "success", "message": "Webhook events fetched", "data": [ "transaction_completed", "transaction_overpayment", "transaction_partially_paid", "transaction_partial_fulfilled", "transaction_requested", "transaction_reserved", "transaction_cancelled", "sub_user_wallet_transaction_detected", "sub_user_wallet_transfer_confirmed", "sub_user_wallet_transfer_failed", "offramp_order_completed", "offramp_order_cancelled", "offramp_order_failed" ] } ``` ## OpenAPI ````yaml GET /v1/api/webhook/events openapi: 3.1.0 info: title: Tender API description: Tender Developer API for cryptocurrency payments and agent management version: 2.0.0 contact: name: Tender Support url: https://tender.cash servers: - url: https://secureapi.tender.cash description: Production Server - url: https://sandbox-api.tender.cash description: Sandbox Server security: - SignedAuth: [] tags: - name: Agents description: Manage agents and sub-businesses - name: Transactions description: Payment and transaction operations - name: System description: System information and configuration - name: Webhooks description: Webhook management and logs - name: On-ramp description: Fiat-to-crypto on-ramp operations - name: Payouts description: Send crypto from merchant balance to a wallet address or payout account - name: Subwallets description: Provision and manage crypto wallet infrastructure for your end-users - name: Conversions description: Swap crypto between coins and chains, or convert to a payout account paths: /v1/api/webhook/events: get: tags: - Webhooks summary: List Webhook Events description: >- List the event names you can subscribe to. `transaction_reserved` is reserved and not currently sent. operationId: listWebhookEvents parameters: - name: authorization in: header required: true description: >- Base64-encoded HMAC-SHA256 signature of `{"timeStamp":"","requestId":"","accessId":""}`, signed with your access secret. The request body is not part of the signature. schema: type: string example: pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0= - name: x-timestamp in: header required: true description: ISO 8601 timestamp; must be within 5 minutes of server time schema: type: string format: date-time example: '2026-10-15T09:45:53.000Z' - name: x-request-id in: header required: true description: A unique UUID v4 per request schema: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 - name: x-access-id in: header required: true description: Your API access ID provided by Tender schema: type: string example: your-access-id-here responses: '202': description: Webhook events fetched content: application/json: schema: $ref: '#/components/schemas/WebhookEventsResponse' example: status: success message: Webhook events fetched data: - transaction_completed - transaction_overpayment - transaction_partially_paid - transaction_partial_fulfilled - transaction_requested - transaction_reserved - transaction_cancelled - sub_user_wallet_transaction_detected - sub_user_wallet_transfer_confirmed - sub_user_wallet_transfer_failed - offramp_order_completed - offramp_order_cancelled - offramp_order_failed '401': description: >- Missing signed headers (`NOT_ALLOWED`) or invalid timestamp, access ID or signature (`INVALID_REQUEST_SIGNATURE`). content: application/json: schema: $ref: '#/components/schemas/WebhookErrorResponse' example: status: error message: INVALID_REQUEST_SIGNATURE data: {} '403': description: Merchant account suspended. content: application/json: schema: $ref: '#/components/schemas/WebhookErrorResponse' example: status: error message: NOT_ALLOWED data: message: This merchant account has been suspended. '429': description: Rate limit exceeded (120 requests per minute for webhook endpoints). content: application/json: schema: $ref: '#/components/schemas/WebhookErrorResponse' example: status: error message: Too many requests. Max 120 per 60s. data: {} security: - SignedAuth: [] components: schemas: WebhookEventsResponse: type: object required: - status - message - data properties: status: type: string enum: - success message: type: string data: type: array items: type: string example: - transaction_completed - transaction_overpayment - transaction_partially_paid - transaction_partial_fulfilled - transaction_requested - transaction_reserved - transaction_cancelled - sub_user_wallet_transaction_detected - sub_user_wallet_transfer_confirmed - sub_user_wallet_transfer_failed - offramp_order_completed - offramp_order_cancelled - offramp_order_failed WebhookErrorResponse: type: object required: - status - message - data properties: status: type: string enum: - error message: type: string data: type: - object - 'null' securitySchemes: SignedAuth: type: apiKey in: header name: authorization description: >- Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.