Skip to main content
WEBHOOK

Authorizations

X-Qonto-Signature
string
header
required

The signature header follows the format t={timestamp},v1={signature}.

Verification steps:

  1. Extract the timestamp and signature from the signature header
  2. Reject the request if the timestamp is older than 5 minutes
  3. Recreate the signed payload: '{timestamp}.{raw_request_body}'
  4. Compute HMAC-SHA256 of the signed payload using your webhook secret as the key
  5. Compare the computed signature with the one in the header

Body

application/json

Webhook payload for topic v1/clients. Delivered whenever a client is created, updated, or deleted.

id
string<uuid>
required

Unique identifier for this webhook event

Example:

"123e4567-e89b-12d3-a456-426614174000"

subscription_id
string<uuid>
required

ID of the webhook subscription that received the event

Example:

"123e4567-e89b-12d3-a456-426614174000"

organization_id
string<uuid>
required

ID of the organization that owns the client

Example:

"123e4567-e89b-12d3-a456-426614174000"

membership_id
string<uuid>
required

ID of the membership associated with the subscription

Example:

"123e4567-e89b-12d3-a456-426614174000"

type
enum<string>
required

Webhook topic

Available options:
v1/clients
Example:

"v1/clients"

created_at
string<date-time>
required

Timestamp when the webhook event was created (RFC3339)

Example:

"2025-01-27T22:05:07.000Z"

data
object
required

Response

200

Webhook received successfully