Create a Webhook Subscription

Register an HTTPS endpoint to receive event notifications. Anton POSTs signed JSON deliveries to the URL you supply every time an event from the events list fires on your merchant account.

Requirements:

The URL must use https:// (enforced outside development environments).
The URL must be publicly reachable — private, loopback, and metadata addresses are rejected.

The response includes a secret — this is shown once at creation. Store it in your secrets manager immediately; Anton cannot recover it later. You can rotate the secret any time via POST /v1/webhooks/{id}/secret/rotate.

See Webhook Events for the event catalog and Webhook Signing for verification.

POST

webhooks

Create a webhook subscription

curl --request POST \
  --url https://api.antonpayments.com/v1/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'DPoP: <api-key>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '
{
  "url": "https://example.com/webhooks/anton",
  "events": [],
  "metadata": {}
}
'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    DPoP: '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({url: 'https://example.com/webhooks/anton', events: [], metadata: {}})
};

fetch('https://api.antonpayments.com/v1/webhooks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.antonpayments.com/v1/webhooks",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => 'https://example.com/webhooks/anton',
    'events' => [
        
    ],
    'metadata' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "DPoP: <api-key>",
    "Idempotency-Key: <idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.antonpayments.com/v1/webhooks"

	payload := strings.NewReader("{\n  \"url\": \"https://example.com/webhooks/anton\",\n  \"events\": [],\n  \"metadata\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("DPoP", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "whk_01HX8Z9K0M2N3P4Q5R6S7T8UW",
  "merchant_id": "<string>",
  "url": "<string>",
  "events": [
    "payout.created"
  ],
  "status": "active",
  "version": "2024-01-01",
  "created_at": "2026-04-15T14:30:00Z",
  "updated_at": "2026-04-15T14:30:00Z",
  "metadata": {},
  "secret": "whsec_0a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef"
}

Authorizations

DPoP

string

header

required

Per-request DPoP proof JWT (RFC 9449). MUST accompany the Authorization: DPoP <access_token> header on every protected operation. The proof is signed by the merchant's private DPoP key and carries htm, htu, iat, jti, and ath claims.

Headers

Idempotency-Key

string

required

Unique key identifying this operation. Sending the same key twice returns the original response instead of creating a duplicate. Keys are retained for 24 hours.

Maximum string length: 255

Body

application/json

url

string<uri>

required

HTTPS URL that will receive deliveries.

Example:

"https://example.com/webhooks/anton"

events

enum<string>[]

required

Event types this subscription should receive. Use ["*"] to subscribe to everything.

See Webhook Events for the full catalog and payload shapes. Some reserved event types (balance.low on some paths) may be defined but not yet dispatched — subscribing to them is safe but no deliveries arrive until they're wired up.

Available options:

payout.created,

payout.approved,

payout.processing,

payout.sent,

payout.completed,

payout.failed,

payout.cancelled,

payout.returned,

payout.screening_failed,

payout.velocity_blocked,

payout.engine_blocked,

beneficiary.created,

beneficiary.updated,

beneficiary.deleted,

beneficiary.blocked,

instrument.created,

instrument.updated,

instrument.deleted,

batch.uploaded,

batch.completed,

batch.failed,

fx.quote.created,

fx.exchange.created,

fx.exchange.completed,

fx.exchange.failed,

funding.credit,

screening.hit,

intelligence.evaluation.completed,

intelligence.evaluation.failed,

balance.low,

test

metadata

object

Show child attributes

Response

Subscription created. Includes the one-time signing secret.

A registered webhook endpoint and its event filter.

string

required

Pattern: ^whk_[a-zA-Z0-9]+$

Example:

"whk_01HX8Z9K0M2N3P4Q5R6S7T8UW"

merchant_id

string

required

Pattern: ^mer_[a-zA-Z0-9]+$

url

string<uri>

required

events

enum<string>[]

required

Available options:

payout.created,

payout.approved,

payout.processing,

payout.sent,

payout.completed,

payout.failed,

payout.cancelled,

payout.returned,

payout.screening_failed,

payout.velocity_blocked,

payout.engine_blocked,

beneficiary.created,

beneficiary.updated,

beneficiary.deleted,

beneficiary.blocked,

instrument.created,

instrument.updated,

instrument.deleted,

batch.uploaded,

batch.completed,

batch.failed,

fx.quote.created,

fx.exchange.created,

fx.exchange.completed,

fx.exchange.failed,

funding.credit,

screening.hit,

intelligence.evaluation.completed,

intelligence.evaluation.failed,

balance.low,

test

status

enum<string>

required

Available options:

active,

inactive

version

string

required

API version this subscription pins to.

Example:

"2024-01-01"

created_at

string<date-time>

required

RFC 3339 / ISO 8601 timestamp in UTC.

Example:

"2026-04-15T14:30:00Z"

updated_at

string<date-time>

required

RFC 3339 / ISO 8601 timestamp in UTC.

Example:

"2026-04-15T14:30:00Z"

metadata

object

Show child attributes

secret

string

Signing secret (whsec_ + 64 hex). Shown once — store it now.

Example:

"whsec_0a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef"

⌘I

Create a webhook subscription

curl --request POST \
  --url https://api.antonpayments.com/v1/webhooks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'DPoP: <api-key>' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '
{
  "url": "https://example.com/webhooks/anton",
  "events": [],
  "metadata": {}
}
'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    Authorization: 'Bearer <token>',
    DPoP: '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({url: 'https://example.com/webhooks/anton', events: [], metadata: {}})
};

fetch('https://api.antonpayments.com/v1/webhooks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.antonpayments.com/v1/webhooks",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'url' => 'https://example.com/webhooks/anton',
    'events' => [
        
    ],
    'metadata' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "DPoP: <api-key>",
    "Idempotency-Key: <idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.antonpayments.com/v1/webhooks"

	payload := strings.NewReader("{\n  \"url\": \"https://example.com/webhooks/anton\",\n  \"events\": [],\n  \"metadata\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("DPoP", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "id": "whk_01HX8Z9K0M2N3P4Q5R6S7T8UW",
  "merchant_id": "<string>",
  "url": "<string>",
  "events": [
    "payout.created"
  ],
  "status": "active",
  "version": "2024-01-01",
  "created_at": "2026-04-15T14:30:00Z",
  "updated_at": "2026-04-15T14:30:00Z",
  "metadata": {},
  "secret": "whsec_0a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef"
}

Overview

Cross-Cutting

Reference Data

Beneficiaries

Instruments

Intelligence

Verifications

Payouts

Batches

Balances

Accounts

Webhooks

Pricing

FX

Corridors

Create a Webhook Subscription

Authorizations

Headers

Body

Response