> ## Documentation Index
> Fetch the complete documentation index at: https://docs.venlyfinance.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register a webhook

> Register an HTTPS endpoint to receive asynchronous Venly Finance events.

**Requires scope:** `manage:webhooks` — see [Required scopes](/getting-started/authentication#required-scopes-finance-api).

Registers a webhook endpoint for your company so Venly can push asynchronous events — pay-in session transitions, pay-out status changes, verification verdicts and settlement outcomes — instead of you polling for them.

The `url` must be an absolute `https://` endpoint.

Pick an `authenticationMethod` so your endpoint can verify the caller:

| Type                   | Fields                 | Behaviour                                    |
| ---------------------- | ---------------------- | -------------------------------------------- |
| `API_KEY`              | `headerName`, `apiKey` | The key is injected into the header you name |
| `BASIC_AUTHENTICATION` | `username`, `password` | Standard HTTP basic auth                     |

<Note>Secrets (`apiKey`, `password`) are write-only. They are accepted here and never echoed back on any read response, so store your own copy — to change one, send a full [update](/api-reference/Finance-API/webhooks/update-a-webhook).</Note>

After registering, [send a ping](/api-reference/Finance-API/webhooks/ping-a-webhook) to validate your endpoint end-to-end.


## OpenAPI

````yaml api-reference/Finance-API-Specs.yaml POST /webhooks
openapi: 3.1.0
info:
  title: Venly Finance API
  description: >
    REST API for the Venly Finance platform:

    - Party management (Individuals & Organisations)

    - Identity verification — hosted KYC/KYB links and Sumsub share-token
    forwarding

    - Account management with party association

    - Wallet balances & token allowances on supported chains

    - Virtual bank accounts for global pay-in (EUR SEPA, USD ACH/WIRE/RTP/SWIFT)

    - Fiat-to-crypto payment sessions (pay-in)

    - Bank pay-outs — beneficiary allow-listing, routes, and PULL/PUSH pay-outs

    - Account-to-account fiat & crypto transfers

    - EIP-2612 permits and allowances

    - Webhook registration for asynchronous event delivery


    ## Authentication


    All endpoints use OAuth2 client credentials. Obtain a token first, then
    include it in every request:


    **Step 1 — Get a token:**

    ```bash

    curl -X POST
    https://login.venly.io/auth/realms/VenlyFinance/protocol/openid-connect/token
    \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "grant_type=client_credentials&client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}"
    ```


    **Step 2 — Use the token:**

    ```

    Authorization: Bearer {access_token}

    ```


    Tokens expire after **5 minutes**. Implement refresh logic in your client.
  version: 1.5.0
  contact:
    name: Venly Support
    email: support@venly.io
    url: https://docs.venlyfinance.com
  license:
    name: Proprietary
  x-logo:
    url: https://venlyfinance.com/logo.png
  x-security-contact: security@venly.io
servers:
  - url: https://api.venlyfinance.com/v1
    description: Production
  - url: https://api-staging.venlyfinance.com/v1
    description: Staging
security:
  - OAuth2: []
tags:
  - name: Parties
    description: Party management (Individuals & Organisations)
  - name: Accounts
    description: Account management, party-role associations
  - name: Wallets
    description: Blockchain wallet balances
  - name: Virtual Bank Accounts
    description: Virtual bank account payment references for global payments
  - name: Fiat-to-crypto Payment Sessions
    description: Fiat-to-crypto payment session creation
  - name: Payout Bank Accounts
    description: Allow-listing beneficiary bank accounts as pay-out destinations
  - name: Payout Routes
    description: >-
      Account-scoped routes pairing a beneficiary bank account with a crypto
      deposit asset
  - name: Payouts
    description: Crypto-to-fiat pay-outs over a registered route
  - name: Transfers
    description: Fiat and crypto transfer operations between accounts
  - name: Permits
    description: EIP-712 permit signature management for token approvals
  - name: Supported Assets
    description: >-
      Discover which chains and assets your tenant can settle in, and whether an
      account can use them yet.
  - name: Allowances
    description: Token allowance management for wallets
  - name: Webhooks
    description: Webhook registration and delivery testing
paths:
  /webhooks:
    post:
      tags:
        - Webhooks
      summary: Register a webhook
      description: >
        **Requires scope:** `manage:webhooks`


        Registers a webhook endpoint for your company so Venly can deliver
        asynchronous events —

        pay-in session transitions, pay-out status changes, verification
        verdicts and settlement

        outcomes — instead of you polling for them.


        The `url` must be an absolute `https://` endpoint.


        Choose an `authenticationMethod` so your endpoint can verify the caller:
        `API_KEY` (the key is

        injected into a header you name) or `BASIC_AUTHENTICATION`. Secrets
        (`apiKey`, `password`) are

        write-only — they are accepted here and never echoed back on any read
        response.
      operationId: createWebhook
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhookRequest'
            example:
              url: https://client.example/hooks/venly
              name: Production events
              authenticationMethod:
                type: API_KEY
                headerName: X-Webhook-Key
                apiKey: whsec_9f2c41ab7d
      responses:
        '201':
          description: Webhook registered
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SingleWebhookResponse'
              example:
                success: true
                result:
                  id: wh_8842f19c
                  url: https://client.example/hooks/venly
                  name: Production events
                  authenticationMethod:
                    type: API_KEY
                    headerName: X-Webhook-Key
                  status: ACTIVE
        '400':
          description: >-
            Invalid request — the `url` is not `https://`, or the authentication
            type is unknown.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: Forbidden — the caller lacks the `manage:webhooks` role.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: Your company has reached the maximum number of registered webhooks.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Webhook management is temporarily unavailable. Retry later.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    CreateWebhookRequest:
      type: object
      description: Registers a webhook endpoint for your company.
      required:
        - url
        - authenticationMethod
      properties:
        url:
          type: string
          format: uri
          maxLength: 2048
          description: Absolute `https://` endpoint the webhook delivers to
          example: https://client.example/hooks/venly
        name:
          type: string
          maxLength: 255
          nullable: true
          description: Optional human-readable label
        authenticationMethod:
          $ref: '#/components/schemas/WebhookAuthenticationMethod'
    SingleWebhookResponse:
      allOf:
        - $ref: '#/components/schemas/BaseResponse'
        - type: object
          properties:
            result:
              $ref: '#/components/schemas/Webhook'
    ErrorResponse:
      type: object
      description: Error response wrapper
      properties:
        success:
          type: boolean
          description: Always false for error responses
          example: false
        errors:
          type: array
          description: List of errors that occurred
          items:
            $ref: '#/components/schemas/ErrorBody'
        result:
          type: object
          nullable: true
          description: Null or omitted when success is false
    WebhookAuthenticationMethod:
      description: >
        Authentication applied to outbound webhook deliveries, discriminated by
        `type`. Secret fields

        (`apiKey`, `password`) are accepted on input and omitted from every read
        response.
      oneOf:
        - $ref: '#/components/schemas/ApiKeyAuthenticationMethod'
        - $ref: '#/components/schemas/BasicAuthenticationMethod'
      discriminator:
        propertyName: type
        mapping:
          API_KEY:
            $ref: '#/components/schemas/ApiKeyAuthenticationMethod'
          BASIC_AUTHENTICATION:
            $ref: '#/components/schemas/BasicAuthenticationMethod'
    BaseResponse:
      type: object
      properties:
        success:
          type: boolean
          description: Indicates whether the request was successful
    Webhook:
      type: object
      description: >-
        A registered webhook. Authentication secrets are omitted from this
        representation.
      required:
        - id
        - url
        - status
      properties:
        id:
          type: string
          example: wh_8842f19c
        url:
          type: string
          format: uri
        name:
          type: string
          nullable: true
        authenticationMethod:
          $ref: '#/components/schemas/WebhookAuthenticationMethod'
        status:
          type: string
          enum:
            - ACTIVE
    ErrorBody:
      type: object
      description: Individual error details
      properties:
        code:
          type: string
          description: Machine-readable error code
          example: invalid-request
        message:
          type: string
          description: Human-readable error message
          example: The request contains invalid parameters.
    ApiKeyAuthenticationMethod:
      type: object
      description: >-
        API-key authentication — the key is injected into the request header you
        name.
      required:
        - type
        - headerName
        - apiKey
      properties:
        type:
          type: string
          enum:
            - API_KEY
        headerName:
          type: string
          maxLength: 255
          description: The request header the API key is sent in
          example: X-Webhook-Key
        apiKey:
          type: string
          maxLength: 2048
          writeOnly: true
          description: Write-only secret. Never returned on read responses.
    BasicAuthenticationMethod:
      type: object
      description: HTTP basic authentication.
      required:
        - type
        - username
        - password
      properties:
        type:
          type: string
          enum:
            - BASIC_AUTHENTICATION
        username:
          type: string
          maxLength: 255
        password:
          type: string
          maxLength: 255
          writeOnly: true
          description: Write-only secret. Never returned on read responses.
  responses:
    Unauthorized:
      description: Authentication required or failed (401)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            success: false
            errors:
              - code: unauthenticated
                message: Please authenticate to perform this action.
  securitySchemes:
    OAuth2:
      type: oauth2
      description: >
        OAuth2 client credentials flow. Token endpoints:

        - Staging:
        https://login-staging.venly.io/auth/realms/VenlyFinance/protocol/openid-connect/token

        - Production:
        https://login.venly.io/auth/realms/VenlyFinance/protocol/openid-connect/token
      flows:
        clientCredentials:
          tokenUrl: >-
            https://login-staging.venly.io/auth/realms/VenlyFinance/protocol/openid-connect/token
          scopes: {}

````