Webhooks overview
Configure, verify, inspect, and replay signed Gate events.
Gate sends an HMAC-signed JSON event to the partner's configured HTTPS webhook_url. Use webhooks as the asynchronous lifecycle signal and reconcile the referenced resource before granting value.
Event types
Session and identity:
gate_session.createdgate_session.processinggate_session.completedgate_session.failedgate_session.expiredgate_session.cancelledgate_session.kyc_package_acceptedkyc.required
Quota:
partner.quota.warningpartner.quota.exhausted
Rails and quotes:
rail.pay_in.processing,rail.pay_in.settled,rail.pay_in.failed,rail.pay_in.cancelledrail.pay_out.processing,rail.pay_out.settled,rail.pay_out.failed,rail.pay_out.cancelledquote.consumed
Customers and testing:
customer.created,customer.updated,customer.deletedwebhook.test
The exact payload schemas are in the OpenAPI webhooks section.
Partner management routes
These accept sk_* or an Account assertion. Writes marked as management require the appropriate Account scope and role when using an assertion.
| Operation | Purpose |
|---|---|
GET /dashboard/webhook-settings |
Read the current destination |
PATCH /dashboard/webhook-settings |
Set an HTTPS destination or null to disable delivery |
POST /dashboard/webhook-secret/rotate |
Replace the signing secret; the new value is returned once |
POST /webhooks/test |
Enqueue a signed synthetic event |
GET /dashboard/webhook-deliveries |
List this partner's delivery health records |
POST /dashboard/webhook-deliveries/{id}/replay |
Requeue an owned dead-lettered delivery |
The delivery log intentionally omits raw event payloads.
Delivery behavior
Network errors, timeouts, 408, 429, and 5xx responses are transient and can be retried. Other 4xx responses are treated as handler errors and reach dead-letter state according to the partner's configured attempt threshold. A replay is allowed only from dead_lettered.
Return a 2xx only after your system has durably accepted the event. Make processing idempotent because a delivery can be retried.