Register a BNPL webhook destination
POST/partner/webhook
Registers a destination for loan_approved events, verified by HMAC signature.
This is the endpoint for BNPL partners, and loan_approved is the BNPL event. If you
integrate Buy Now, Pay Later, this is the route to use — including for a brand-new
integration. The self-service endpoint
POST /partner/webhook/subscription rejects
BNPL partners outright, so this is not a deprecated fallback: it is your registration route.
What you get
A destination created here is subscribed to loan_approved and nothing else, and always
verifies by HMAC. Both are fixed at creation and cannot be changed afterwards — see
Verify HMAC Signatures. For the payload, see
loan_approved in the Event Catalog.
The body is just the URL
Only url is read. Any other field is ignored rather than rejected, so a request
carrying eventTypes or filters still returns 201 and those fields have no effect. Event
selection and filtering are features of the real-estate route, not this one.
The secret
The response body is the secret, as a plain string under data. It is shown once —
GET /partner/webhook never returns it.
Request
Responses
- 201
- 401
- 403
- 409
- 422
- 429
Destination registered
Unauthorized - Invalid or missing API credentials
Forbidden - Partner is inactive
Conflict (ERR_PARTNER_WEBHOOK_ALREADY_EXISTS) - This URL is already registered. The
endpoint does not duplicate the destination and does not rotate its secret.
Unprocessable Entity. One of:
ERR_MISSING_DATA (url absent or empty) ·
ERR_INVALID_DATA (not HTTPS, or resolves to a private/loopback address) ·
ERR_TOO_MANY_PARTNER_WEBHOOKS (you already have 10 active destinations)
Too Many Requests - Rate limit exceeded