Skip to main content
WEBHOOK

Headers

X-OpenFX-Signature
string
required

t=<unix-timestamp>,v1=<hex-hmac>: a hex-encoded HMAC-SHA256 signature computed over {timestamp}.{raw_body} (the exact bytes sent, not a re-serialized copy) using your organization's signing secret for that environment. Reject if t is more than 300 seconds from now, then verify v1 with a constant-time compare. See Webhook authentication. Dedup on the delivered event's id, not on this header.

Example:

"t=1735689600,v1=5257a869e7bfbe00e0be2007c1b7be16bb2ba57ee233b0d0c4de5d83b3f5e01d"

Body

application/json

Root standing status moved to REQUIRES_INFORMATION: OpenFX has asked for information about the account, so a payout is blocked exactly as under PENDING while that stands. The request and its fulfillment travel through your operational channel with OpenFX, not through the API. data.previousStatus says whether it moved from PENDING or ACTIVE.

object
string
required

The type of object represented, a fixed discriminator. Always "event" for this resource, and identical across every object of the type.

Allowed value: "event"
Example:

"event"

id
string
required

Event identifier, the client's dedup key for this delivery.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{21,22}$
Example:

"evt_5EdynMEiYSyiWAH9GpcbHp"

type
string
required

Resource noun this event is about, the plural of the resource segment in eventType. Route coarsely on this; switch on eventType for the specific transition.

Allowed value: "accounts"
Example:

"accounts"

eventType
string
required

Product-namespaced lowercase {product}.{resource}.{action} event type, the product segment mirroring the resource's URL, the one lowercase-enum exception on this platform (every other enum is SCREAMING_SNAKE).

Allowed value: "common.account.requires_information"
Example:

"common.account.requires_information"

createdAt
string<date-time>
required

Event timestamp.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$
Example:

"2026-06-04T10:30:00.000Z"

data
object
required

The Account resource plus event-only context, embedded as data on the account's root events: common.account.created, common.account.activated, common.account.rejected, common.account.requires_information and common.account.archived.

data.status carries the root standing as it stood when the event was emitted and data.previousStatus the one it moved from. Each capability's status rides on data.capabilities[], and each capability's settle is announced by the common.account.capability_* events. identity is not delivered to webhook endpoints; read it from GET /v3/common/accounts/{accountId}.

Response

200

Return any 2xx to acknowledge receipt of the event.