Public developer API

POST /v1/webhooks

Registers (or replaces) your single webhook URL and returns a new signing secret, shown once.

Access

A project-specific API key (Authorization: Bearer dapi_live_...) and its Business ID (X-Business-Id). Rate limited per business (120 calls a minute by default).

Events: collection.received, collection.failed, payout.completed, payout.failed, deposit.received, exchange.completed, exchange.failed, card.issued, card.funded, card.withdrawn, card.funding_failed, card.transaction, card.refund. See Webhooks for each payload.

Each delivery carries X-Dutch-Event and X-Dutch-Signature: t=<unix>,v1=<hex> where v1 is HMAC-SHA256 of <t>.<raw body> with your signing secret. Reject deliveries older than 5 minutes.

In production the URL must be public https.

Body

Example request

curl --request POST \
  --url 'https://production.dutchapi.co/v1/webhooks' \
  --header 'X-Business-Id: YOUR_BUSINESS_ID' \
  --header 'Authorization: Bearer bsk_live_YOUR_BUSINESS_SECRET' \
  --header 'Content-Type: application/json' \
  --data '{"url":"https://example.com/webhooks/dutch"}'

Response 201

{
  "url": "https://example.com/webhooks/dutch",
  "signing_secret": "whsec_...",
  "events": [
    "collection.received",
    "collection.failed",
    "payout.completed",
    "payout.failed",
    "deposit.received",
    "exchange.completed",
    "exchange.failed",
    "card.issued",
    "card.funded",
    "card.withdrawn",
    "card.funding_failed",
    "card.transaction",
    "card.refund"
  ]
}

Errors