POST
/
webhooks
/
subscriptions
/
{webhookSubscriptionId}
/
test
Send test webhook delivery.
curl --request POST \
  --url https://sandbox.api.openfx.com/v1/webhooks/subscriptions/{webhookSubscriptionId}/test \
  --header 'Authorization: Bearer <token>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>'
{
  "id": "whd_01953e1a5f4b7100",
  "webhookSubscriptionId": "wsub_01953e1a5f4b700a",
  "eventType": "entity.created",
  "status": "pending",
  "createdAt": "2026-02-23T12:00:00Z",
  "eventId": "evt_01953e1a5f4b7009",
  "httpStatus": 123,
  "attemptCount": 123,
  "nextRetryAt": "2026-02-23T12:00:00Z",
  "payload": {
    "id": "whd_01953e1a5f4b7100",
    "type": "entity.created",
    "createdAt": "2026-02-23T12:00:00Z",
    "data": {
      "resourceType": "<string>",
      "resourceId": "<string>",
      "snapshot": {}
    },
    "previousAttributes": {}
  }
}

Authorizations

​
Authorization
string
header
required

API key issued at onboarding. Passed as a Bearer token in the Authorization header: Authorization: Bearer <api-key>. Identifies the caller and determines organization scope. Invalid or revoked keys return 401 with error type authentication_error.

​
X-Signature
string
header
required

Ed25519 or RSA-SHA256 asymmetric signature over the request payload (ADR-0015). Provides request integrity and non-repudiation. The signature covers the HTTP method, path, query string, request body, and timestamp. Invalid signatures return 401 with error type authentication_error.

​
X-Timestamp
string
header
required

Unix timestamp (seconds) of when the request was signed. Server rejects requests where the timestamp drifts beyond +/-60 seconds from server time to prevent replay attacks. Must match the timestamp used in the signature computation.

Headers

​
Idempotency-Key
string
required

Idempotency key for this request. UUID v4 recommended. Max 128 characters. 24-hour retention. Same key + same body replays original response with Idempotency-Replayed: true. Same key + different body returns 409 (code: duplicate_idempotency_key). Same key while the original request is still processing returns 409 with a Retry-After header (code: idempotency_key_in_flight).

Maximum string length: 128
Example:

"550e8400-e29b-41d4-a716-446655440000"

Path Parameters

​
webhookSubscriptionId
string
required

Unique identifier of the webhook subscription (wsub_ prefix). Webhook subscription resource identifier.

Pattern: ^wsub_[A-Za-z0-9]+$
Example:

"wsub_01953e1a5f4b700a"

Response

Test delivery sent.

A single webhook delivery attempt.

​
id
string
required

Webhook delivery resource identifier.

Pattern: ^whd_[A-Za-z0-9]+$
Example:

"whd_01953e1a5f4b7100"

​
webhookSubscriptionId
string
required

Webhook subscription resource identifier.

Pattern: ^wsub_[A-Za-z0-9]+$
Example:

"wsub_01953e1a5f4b700a"

​
eventType
enum<string>
required

Type of event. Namespaced as resource.action.

Available options:
entity.created,
entity.updated,
entity_relationship.created,
entity_relationship.deleted,
customer.created,
customer.status_changed,
customer.kyb_status_changed,
account.created,
account.status_changed,
account_number.created,
account_number.status_changed,
blockchain_address.created,
counterparty.created,
counterparty.activated,
counterparty.archived,
payment_method.created,
payment_method.validated,
payment_method.rejected,
payment.created,
payment.requires_action,
payment.in_review,
payment.processing,
payment.completed,
payment.returned,
payment.reversed,
payment.refunded,
payment.failed,
payment.canceled,
inbound_payment.received,
inbound_payment.completed,
inbound_payment.returned,
inbound_payment.requires_attribution,
conversion.created,
conversion.processing,
conversion.completed,
conversion.failed,
transfer.created,
transfer.completed,
transfer.failed,
transaction.created,
refund.created,
refund.completed,
refund.failed,
onboarding.created,
onboarding.completed,
onboarding.failed,
collection.created,
collection.requires_action,
collection.submitted,
collection.processing,
collection.completed,
collection.returned,
collection.failed,
collection.canceled,
settlement_route.created,
settlement_route.activated,
settlement_route.deactivated,
settlement_route.updated,
settlement_route.executed
​
status
enum<string>
required

Delivery status of a webhook attempt.

Available options:
pending,
delivered,
failed
​
createdAt
string<date-time>
required

UTC timestamp in RFC 3339 / ISO 8601 format.

Example:

"2026-02-23T12:00:00Z"

​
eventId
string

Event resource identifier.

Pattern: ^evt_[A-Za-z0-9]+$
Example:

"evt_01953e1a5f4b7009"

​
httpStatus
integer

HTTP status code returned by the endpoint.

​
attemptCount
integer

Number of delivery attempts made.

​
nextRetryAt
string<date-time> | null

UTC timestamp in RFC 3339 / ISO 8601 format.

Example:

"2026-02-23T12:00:00Z"

​
payload
object

The webhook payload that was (or will be) delivered to the endpoint.