Register a webhook endpoint
Events from your chosen catalogue subset are POSTed to the URL, signed. The response carries the signing secret IN FULL, exactly once — store it; reads only ever show a preview. Payloads are thin (id + type + resource pointer): fetch the object through the read endpoints.
Events from your chosen catalogue subset are POSTed to the URL, signed. The response carries the signing secret IN FULL, exactly once — store it; reads only ever show a preview. Payloads are thin (id + type + resource pointer): fetch the object through the read endpoints.
Authorization
bearer In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
The endpoint to deliver events to, and the events to send it.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/partner/v1/webhooks" \ -H "Content-Type: application/json" \ -d '{ "events": [ "deposit.settled", "withdrawal.settled" ], "url": "https://partner.example.com/tcb/webhooks" }'{ "data": { "createdAt": "2026-08-14T08:42:11.000Z", "disclosure": { "items": [ "ENVIRONMENT_IS_TESTNET: The environment is a testnet (Arbitrum Sepolia). No mainnet deployment exists.", "YIELD_IS_SIMULATED: The vault rate is set administratively and the interest it produces is minted as fresh underlying, not earned. It does not represent a return generated by deployed capital.", "FIAT_RAILS_ARE_MOCKED: No real fiat movement occurs. Balances are ledger entries against a sandbox provider.", "CONVERSION_RATES_ARE_MARKET_QUOTED_OR_REFUSED: A conversion is priced only by an external venue that quotes independently of TCB. When no such venue can price the pair, the conversion is refused rather than priced from an internal table. Read rate.pricingModel on every conversion: MARKET is a venue quote; any other value is not a market rate and must not be presented as one.", "CONTRACTS_ARE_UNAUDITED: No audit has been performed. Mainnet is gated on a two-firm audit that has not been commissioned.", "CUSTODY_IS_TCB_SUBACCOUNT: Everything held for the client — its vault shares, and the tcbUSD it holds between the steps of the tokenised deposit chain — is held in TCB custody, in the one TCB wallet assigned to the client. The client holds no keys and moves those tokens only through this API; each sub-account's shares and tcbUSD are book entries against what that wallet holds.", "INTEGRATION_AGREEMENT_ONLY: Fees as published on the rate card; no yield share, no return commitment." ], "summary": "This is a pilot integration on a testnet. Nothing in this system earns anything: the yield is simulated and the fiat rails are mocked.", "version": "2026-10-27" }, "events": [ "deposit.settled", "withdrawal.settled" ], "previousSecretExpiresAt": "2026-09-03T10:15:30.000Z", "secret": "whsec_k3vJ9aQ2mR7xL0pT4wZ8nB1yC6dF5gH2jK9sV3eA7u", "secretPreview": "whsec_k3vJ9aQ2…", "status": "ACTIVE", "url": "https://partner.example.com/tcb/webhooks", "webhookId": "4e8b1d70-a35c-4692-b0f1-9d2c6a4e73b8" }, "success": true, "timestamp": "2026-09-02T10:15:30.000Z"}List your webhook endpoints GET
Registry rows, oldest first. Secrets are shown as previews only.
Fetch one webhook endpoint by id GET
The subscription as registered: its URL, the events it receives, whether it is still active, and a preview of the secret currently signing its deliveries. The full secret is never returned by a read — only by the call that minted it.