Skip to main content
WEBHOOK

Authorizations

X-API-Key
string
header
required

API key (wg_live_…) created in the dashboard (Account → API Keys). Shown once at creation; only a hash is stored server-side.

Headers

X-Wizzgift-Signature
string
required

t=<unix-ms>,v1=<hmac-sha256-hex> — up to two v1 entries during the 24 h secret-rotation window. HMAC is over "<t>.<raw body>".

X-Wizzgift-Event
enum<string>
required
Available options:
payment.detected,
payment.confirmed,
order.completed,
order.partial,
order.failed,
refund.initiated,
refund.completed,
refund.failed
X-Wizzgift-Delivery
string
required

Delivery id (whd_…) — stable across retries; use as your idempotency key.

Body

application/json
id
string
required

Delivery id (whd_…) — your idempotency key; stable across retries.

Example:

"whd_Xy12Ab34Cd56"

type
string
required

Event type (WebhookEventType or ping).

Allowed value: "payment.confirmed"
createdAt
integer<int64>
required

Unix timestamp in milliseconds (UTC).

Example:

1753142400000

data
object
required

Order snapshot. NEVER contains card codes — fetch those via the authenticated GET.

Response

200

Acknowledged.