> ## Documentation Index
> Fetch the complete documentation index at: https://docs.caratuva.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an outbound webhook subscription

> Subscribe an HTTPS endpoint to one or more event types. Caratuva POSTs each matching event signed with a per-subscription HMAC secret (the `x-caratuva-signature` header). The signing `secret` is returned ONCE in this response and is never retrievable again — persist it now so you can verify delivery signatures; if you lose it, rotate the secret to mint a new one.



## OpenAPI

````yaml https://api.caratuva.com/docs-json post /v1/webhooks
openapi: 3.0.0
info:
  title: Caratuva API
  description: >-
    Cross-border B2B payments. Fiat on-ramp → USDC → PIX off-ramp.


    Every request runs in **test** or **live** mode on this single host — there
    is no separate sandbox URL. API keys carry the mode in their prefix
    (`pk_test_…` / `pk_live_…`); dashboard JWTs start in test and re-mint via
    `POST /v1/auth/switch-mode`. Test mode runs the full pipeline against a
    sandbox payment instance (KYB/KYC auto-approve, no real money); live runs on
    real rails and requires approved KYB. Test and live data are fully isolated.
    Check readiness with `GET /v1/onboarding/status`.
  version: 1.0.0
  contact: {}
servers: []
security: []
tags:
  - name: Invoices
    description: Create and manage invoices that collect for one of your sellers.
  - name: Payments
    description: Create a payment (keep your own checkout), fetch it, or cancel it.
  - name: Accounts
    description: >-
      Onboard and manage your sellers, buyers, and your own (self) account at
      the settlement partner.
  - name: Webhooks
    description: Subscribe to outbound event notifications and manage signing secrets.
  - name: API keys
    description: Issue, list, and revoke the API keys that authenticate your integration.
  - name: Access
    description: Request and check production (live-mode) access for your organization.
  - name: Reports
    description: Pull settlement and transfer-pricing reports.
paths:
  /v1/webhooks:
    post:
      tags:
        - Webhooks
      summary: Create an outbound webhook subscription
      description: >-
        Subscribe an HTTPS endpoint to one or more event types. Caratuva POSTs
        each matching event signed with a per-subscription HMAC secret (the
        `x-caratuva-signature` header). The signing `secret` is returned ONCE in
        this response and is never retrievable again — persist it now so you can
        verify delivery signatures; if you lose it, rotate the secret to mint a
        new one.
      operationId: WebhooksOutboundController_create
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                url:
                  type: string
                  format: uri
                eventTypes:
                  type: array
                  items:
                    type: string
                    enum:
                      - invoice.created
                      - invoice.approved
                      - invoice.buyer_invited
                      - invoice.buyer_kyc_approved
                      - invoice.buyer_kyc_rejected
                      - invoice.on_ramp_started
                      - invoice.fiat_received
                      - invoice.on_chain_confirmed
                      - invoice.offramp_initiated
                      - invoice.settled
                      - invoice.offramp_failed
                      - invoice.failed
                      - invoice.cancelled
                      - invoice.expired
                      - payment_intent.created
                      - payment_intent.buyer_kyc_approved
                      - payment_intent.buyer_kyc_rejected
                      - payment_intent.on_chain_confirmed
                      - payment_intent.settled
                      - payment_intent.failed
                      - payment_intent.cancelled
                      - payment_intent.expired
                      - connected_account.created
                      - connected_account.kyb_approved
                      - connected_account.kyb_rejected
                      - connected_account.ready_to_collect
                  minItems: 1
                  maxItems: 32
              required:
                - url
                - eventTypes
              additionalProperties: false
            examples:
              default:
                value:
                  url: https://erp.example.com/webhooks/caratuva
                  eventTypes:
                    - payment_intent.settled
                    - payment_intent.failed
      responses:
        '201':
          description: >-
            Subscription created — `secret` is surfaced ONCE; persist it on your
            side.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  orgId:
                    type: string
                  url:
                    type: string
                  eventTypes:
                    type: array
                    items:
                      type: string
                  active:
                    type: boolean
                  createdAt:
                    type: string
                  updatedAt:
                    type: string
                  secret:
                    type: string
                required:
                  - id
                  - orgId
                  - url
                  - eventTypes
                  - active
                  - createdAt
                  - updatedAt
                  - secret
                additionalProperties: false
              examples:
                default:
                  value:
                    id: ckwh001
                    orgId: ckorg001
                    url: https://erp.example.com/webhooks/caratuva
                    eventTypes:
                      - payment_intent.settled
                      - payment_intent.failed
                    active: true
                    createdAt: '2026-06-30T12:00:00.000Z'
                    updatedAt: '2026-06-30T12:00:00.000Z'
                    secret: whsec_3f9a1c7e0b2d4f6a8c1e3b5d7f9a0c2e
        '400':
          description: >-
            ValidationError — url must be a valid URL and eventTypes must
            contain 1–32 known event types.
          content:
            application/json:
              schema:
                type: object
                properties:
                  statusCode:
                    type: integer
                    example: 400
                  error:
                    type: string
                    example: ValidationError
                  message:
                    type: string
                    example: >-
                      url must be a valid URL and eventTypes must contain 1–32
                      known event types.
      security:
        - apiKey: []
        - bearer: []
components:
  securitySchemes:
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http

````