Skip to main content
POST
Register a webhook endpoint

Authorizations

Authorization
string
header
required

Username = your client id. Password = your client secret.

So the base64-encoded username:password described below is client_id:client_secret:

Most HTTP clients build that header for you:

Both values come from Developers → Apps → your app. The secret is shown once at creation and is prefixed oac_.

Body

application/json
url
string<uri>
required

The HTTPS URL that will receive event deliveries for every user your app manages.

Maximum string length: 512
events
enum<string>[]
required

The event types this endpoint should receive: the bank-data events (transactions.created, transactions.updated, balance.updated, holdings.updated, account.*), the connection lifecycle (connection.*) and portal.user.verified. Legacy bank_account.* aliases are not available on this surface.

Minimum array length: 1
Available options:
transactions.created,
transactions.updated,
balance.updated,
holdings.updated,
account.created,
account.updated,
account.deleted,
connection.created,
connection.activated,
connection.reauthorized,
connection.expiring,
connection.expired,
connection.failing,
connection.recovered,
connection.disabled,
connection.deleted,
portal.user.verified
description
string | null

Optional label to help you identify the endpoint.

Maximum string length: 255
enabled
boolean

Whether the endpoint receives deliveries. Defaults to true.

omit_sensitive_identifiers
boolean

When true, sensitive account identifiers (IBAN/BBAN) are omitted from delivered payloads. They are omitted regardless unless your app has been approved for the sensitive:read scope.

financial_accounts
string

Not available on app-level endpoints: an app receives events for every user it manages, so a per-account filter has no meaning here.

payload_version
string

Not available on app-level endpoints: deliveries always use the current (v2) payload shape.

type
string

Response

The response is of type object.