Skip to main content
Configuration, test and replay mutations return WEBHOOKS_DISABLED while delivery is disabled. Authenticated GET routes continue to expose retained events and delivery history for recovery.
Authenticate with Authorization: Bearer YOUR_APPLICATION_SECRET_KEY. Use https://sandbox.api.prava.space for sandbox and https://api.prava.space for production. The key identifies the application; you cannot choose a different owner in a request body. Create, rotate, and replay require an Idempotency-Key header (8–120 letters, digits, underscores, or hyphens). Reuse the same key when retrying a request. Creating with changed input and the same key fails with a conflict. One-time signing secrets are returned only on the original successful create/rotation response; retries report completion without redisclosing the secret.
Creation returns { "endpoint": { ... }, "signing_secret": "whsec_..." }; the endpoint starts paused and unverified. PATCH accepts any of name, url, events, and enabled. You must verify before enabling. Test accepts { "type": "payment.succeeded" }. Other POST control operations accept an empty body. History APIs return next_cursor or null; return the cursor unchanged on the next request. Errors use { "error": { "code": "...", "message": "..." } }. Owner-scoped missing resources return 404; unsupported operations/verification state return 409. Direct API secret keys grant control over their application’s webhook configuration. Dashboard role restrictions apply to dashboard users. Do not give application secret keys to readonly team members. Filter /v1/events with type, resource_id (txn_... or ses_...), from (inclusive ISO timestamp) and to (exclusive ISO timestamp). When both times are provided, use an increasing range of at most 30 days. Keep the same filters while advancing cursor. Events remain scoped to the authenticated application and environment. For a non-financial worker check, send { "type": "card_enrollment.completed", "queued": true } to the test route after activating the verified endpoint. It returns { "queued": true, "event_id": "evt_..." }; inspect delivery history for acceptance/retries. Every synthetic payload has test: true and contains example data. This verifies delivery, not enrollment or financial provider behavior. Verify and Send test return 422 WEBHOOK_RECEIVER_UNAVAILABLE when the public receiver cannot be reached securely. Check public DNS, HTTPS certificate and availability before retrying. 409 WEBHOOK_CHALLENGE_FAILED means the signed verification challenge was not echoed in a complete JSON response; echo the exact challenge value with 2xx. Internal signing/storage outages remain platform errors. For control operations without a payload, omit Content-Type: application/json; use that header when actually sending JSON.