Skip to main content
WEBHOOK

Authorizations

X-Webhook-Signature
string
header
required

HMAC-SHA256 signature supplied on every webhook delivery. The signature is computed from the raw request body using the webhook secret supplied during creation of the webhook subscription.

Webhook receivers can cryptographically verify this header before processing the event to ensure the authenticity of the webhook delivery.

Refer to the verify signatures documentation to learn details about the full payload and the exact verification algorithm.

X-Hook0-Signature is deprecated and will eventually be removed. Use X-Webhook-Signature going forward. Both headers are sent with identical values and use the same verification algorithm and webhook secret.

This scheme applies to webhook delivery (outbound POSTs from CDP to your endpoint), not to inbound CDP API requests.

Headers

X-Webhook-Signature
string
required

HMAC-SHA256 signature supplied on every webhook delivery. The signature is computed from the raw request body using the webhook secret supplied during creation of the webhook subscription.

Webhook receivers can cryptographically verify this header before processing the event to ensure the authenticity of the webhook delivery.

Refer to the verify signatures documentation to learn details about the full payload and the exact verification algorithm.

X-Hook0-Signature is deprecated and will eventually be removed. Use X-Webhook-Signature going forward. Both headers are sent with identical values and use the same verification algorithm and webhook secret.

This scheme applies to webhook delivery (outbound POSTs from CDP to your endpoint), not to inbound CDP API requests.

X-Hook0-Signature
string
required

HMAC-SHA256 signature supplied on every webhook delivery. The signature is computed from the raw request body using the webhook secret supplied during creation of the webhook subscription.

Webhook receivers can cryptographically verify this header before processing the event to ensure the authenticity of the webhook delivery.

Refer to the verify signatures documentation to learn details about the full payload and the exact verification algorithm.

X-Hook0-Signature is deprecated and will eventually be removed. Use X-Webhook-Signature going forward. Both headers are sent with identical values and use the same verification algorithm and webhook secret.

This scheme applies to webhook delivery (outbound POSTs from CDP to your endpoint), not to inbound CDP API requests.

Body

application/json

The acceptance.mandate.revocation_succeeded webhook event payload.

The acceptance.mandate.revocation_succeeded event. data carries the full mandate and the revocation. The spending allowance has been removed on-chain, mandate.revokedAt is set, and mandate.status becomes revocation_succeeded. This is terminal. It applies regardless of whether the mandate was previously canceled (canceledAt remains set).

eventId
string<uuid>
required

Unique identifier for this webhook event. Use this for idempotency.

Example:

"123e4567-e89b-12d3-a456-426614174000"

timestamp
string<date-time>
required

When this event occurred (ISO 8601 format).

Example:

"2025-06-01T12:00:00Z"

data
object
required

The data payload for every mandate webhook event. Always contains the full mandate. Action events also carry the relevant sub-resource: approval on the three approval_* events, revocation on the three revocation_* events. The created and canceled events carry only the mandate.

mandate.status reflects only the latest action. Read mandate.canceledAt and mandate.revokedAt to know what has durably happened: the on-chain spending allowance is gone precisely when revokedAt is set, and canceling alone does not remove it.

Example:
eventType
enum<string>
required

The type of webhook event.

Available options:
acceptance.mandate.revocation_succeeded
Example:

"acceptance.mandate.revocation_succeeded"

Response

Webhook received and processed successfully.