Skip to main content
WEBHOOK

Headers

​
X-OpenFX-Signature
string
required

t=<unix-timestamp>,v1=<hex-hmac>: a hex-encoded HMAC-SHA256 signature computed over {timestamp}.{raw_body} (the exact bytes sent, not a re-serialized copy) using your organization's signing secret for that environment. Reject if t is more than 300 seconds from now, then verify v1 with a constant-time compare. See Webhook authentication. Dedup on the delivered event's id, not on this header.

Example:

"t=1735689600,v1=5257a869e7bfbe00e0be2007c1b7be16bb2ba57ee233b0d0c4de5d83b3f5e01d"

Body

application/json

Readiness status moved to REJECTED: a setup act on this payout address returned a blocking result or failed, so it may not back payouts. Fires however fast the act settled: an address whose setup fails inside the create call is already REJECTED on the create response, and this event still announces the settle. data.previousStatus says which state it fell from: PENDING during setup, ACTIVE on a later act, or REQUIRES_INFORMATION.

Where the cause is a verification act it is in data.verifications: a NO_MATCH name match is the blocking result shown there. A rejection whose verifications all stand clear reports no further cause.

​
object
string
required

The type of object represented, a fixed discriminator. Always "event" for this resource, and identical across every object of the type.

Allowed value: "event"
Example:

"event"

​
id
string
required

Event identifier, the client's dedup key for this delivery.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{21,22}$
Example:

"evt_5EdynMEiYSyiWAH9GpcbHp"

​
type
string
required

Resource noun this event is about, the plural of the resource segment in eventType. Route coarsely on this; switch on eventType for the specific transition.

Allowed value: "payout_addresses"
Example:

"payout_addresses"

​
eventType
string
required

Product-namespaced lowercase {product}.{resource}.{action} event type, the product segment mirroring the resource's URL, the one lowercase-enum exception on this platform (every other enum is SCREAMING_SNAKE).

Allowed value: "payments.payout_address.rejected"
Example:

"payments.payout_address.rejected"

​
createdAt
string<date-time>
required

Event timestamp.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$
Example:

"2026-06-04T10:30:00.000Z"

​
data
object
required

The PayoutAddress resource plus event-only context, embedded as data on every payments.payout_address.* webhook/event.

Where a verification act drove a status change, that act's result is in the payload. bankAccount and the acts' name strings are not delivered to webhook endpoints; read them from GET /v3/payments/payout-addresses/{payoutAddressId}.

Response

200

Return any 2xx to acknowledge receipt of the event.