Skip to main content
WEBHOOK

Authorizations

X-Hook0-Signature
string
header
required

HMAC-SHA256 signature of the raw request body, computed using your webhook secret. Webhook receivers should always verify this header before processing the event. The header value is hex-encoded and prefixed by the algorithm and timestamp, e.g. t=1700000000,v1=abc123... (refer to the Webhook Security docs for the exact verification algorithm).

This scheme applies to webhook delivery (outbound POSTs from CDP to your endpoint), not to inbound CDP API requests.

Body

application/json

The acceptance.top_up_link.created webhook event payload.

The acceptance.top_up_link.created event. Emitted when a Top-Up Link is created. data.topUpLink carries the complete immutable resource. The link expires 24 hours after creation, funds a single purchase, and is not bound to a specific payer. data.topUpLink.customerDisplay.merchantName contains the resolved name stored at creation, including the entity's profile-name fallback.

eventId
string<uuid>
required

Unique identifier for this webhook event. Use this for idempotency.

Example:

"123e4567-e89b-12d3-a456-426614174000"

timestamp
string<date-time>
required

When this event occurred (ISO 8601 format).

Example:

"2026-09-11T20:00:00Z"

eventType
enum<string>
required

The type of webhook event.

Available options:
acceptance.top_up_link.created
Example:

"acceptance.top_up_link.created"

data
object
required

The data payload for the acceptance.top_up_link.created event. Carries the complete immutable topUpLink resource as created, including the resolved customerDisplay.merchantName. orderTotalAmount and redirectUrl are omitted when they were not supplied at creation.

Example:

Response

Webhook received and processed successfully.