Skip to main content

List webhooks

GET 
/v1/webhooks

Nuntiq POSTs signed JSON events to a webhook's URL, so an integration does not have to poll. Events:

  • invoice.ready_for_integration: an invoice can be claimed (the ERP pull path of the workflow, a release, a confirmation)
  • invoice.integration_result: a result was recorded (API, portal, connector timeout, skip)
  • payment.applied: a payment and the invoices it pays
  • inbound_file.processed: a data file of POST /inbound-files was consumed or failed
  • invoice.lifecycle_message: a lifecycle message (never the internal note)
  • supplier.bank_details_changed: a supplier's bank accounts changed (numbers as their last four characters)
  • api_key.rotated: a key of an API user was created, rotated or revoked (action), in the portal or through the API; never the key itself
  • api_key.expiring: a key expires in 30, 7 or 1 days (days_left), so the integration can rotate it with POST /api-user/keys/rotate

Each request carries X-Nuntiq-Signature: t=TIMESTAMP,v1=SIGNATURE (TIMESTAMP in Unix seconds, SIGNATURE the hex HMAC-SHA256 of TIMESTAMP.RAW_BODY). Verify it with the secret and reject old timestamps. After a secret rotation the header carries a second v1= (signed with the previous secret) until previous_secret_expires_at (24 hours by default): accept the request when any v1 matches, so you can switch to the new secret without missing deliveries. Answer 2xx within 10 seconds; otherwise Nuntiq retries after 1, 5, 15 and 30 minutes, then hourly and every 4 hours, for 24 hours. Events can arrive twice or out of order: deduplicate on the event id and read the current state when order matters. Right: MANAGE_WEBHOOKS. A key limited to organizations creates webhooks limited to them and sees only its own. At most 20 webhooks per tenant. Customers also manage them in the customer portal (Integrations, Webhooks).

Responses​

The webhooks and the event types