Skip to main content
WEBHOOK

Headers

​
X-OpenFX-Signature
string
required

t=<unix-timestamp>,v1=<hex-hmac>: a hex-encoded HMAC-SHA256 signature computed over {timestamp}.{raw_body} (the exact bytes sent, not a re-serialized copy) using your webhook signing secret. Reject if t is more than 300 seconds from now, then verify v1 with a constant-time compare. See Webhook authentication.

Example:

"t=1735689600,v1=5257a869e7bfbe00e0be2007c1b7be16bb2ba57ee233b0d0c4de5d83b3f5e01d"

​
X-OpenFX-Webhook-Version
string
required

Webhook payload contract version, currently v3. Lets a receiver branch on the envelope version across future changes. See Webhooks.

Example:

"v3"

Body

application/json

Webhook delivery envelope for withdrawal status changes. data is the withdrawal in its current state.

​
id
string
required

Webhook delivery identifier, readable typed-prefix ID (evt_ prefix). The deduplication key — a single event may be delivered more than once on retries; deduplicate on this value.

Pattern: ^evt_[1-9A-HJ-NP-Za-km-z]{1,22}$
Example:

"evt_NDqQ9LmcUASpnHR6CTvdkk"

​
type
string
required

Resource noun naming the event subject. Always withdrawals for withdrawal events.

Example:

"withdrawals"

​
eventType
enum<string>
required

Dot-namespaced, product-prefixed event name ({product}.{resource}.{action}).

Available options:
fx.withdrawal.completed
​
createdAt
string<date-time>
required

RFC 3339 UTC timestamp (millisecond precision) at which OpenFX built and dispatched this delivery. Not when the withdrawal itself settled; see data.completedAt for that.

Pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$
Example:

"2026-04-28T10:00:00.000Z"

​
data
object
required

The withdrawal in its current state (v3 conventions: camelCase keys, string amounts).

Response

200

Return any 2xx to acknowledge receipt. A non-2xx response or a timeout causes OpenFX to retry on its published delivery schedule.