Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

Pass your API key as a bearer token: Authorization: Bearer <API_KEY>.

Headers

X-Karat-Signature
string
required

HMAC-SHA256 signature of the delivery, in the format v1=<base64>.

X-Karat-Webhook-Timestamp
string
required

Unix epoch seconds when the event was sent. Used in the signed payload and for replay protection.

X-Karat-Subscription-Id
string<uuid>
required

The subscription this delivery belongs to. Use it to look up the signing secret.

X-Karat-Webhook-Id
string<uuid>
required

Unique delivery ID, for deduplication.

Body

application/json

Envelope delivered to your callback URL when an event fires.

id
string<uuid>

Unique ID for this delivery.

event
string
Example:

"payout.updated"

created_at
string<date-time>
subscription_id
string<uuid>
data
object

Event-specific payload.

Response

200

Return a 2xx status to acknowledge receipt.