Webhooks: API examples

Generated from the public OpenAPI. Examples illustrate the contract and are not live results. Use your assigned gateway, credentials and identifiers. The snippets do not execute automatically.

Use Node.js 22 or later. Copy the setup below into an .mjs file, set QFP_BASE_URL and QFP_ACCESS_TOKEN, then append the operation snippet you need. No repository checkout or downloaded client is required. Keep secrets in your backend and persist each write key and body before sending.

Request setup

const required = name => {
  const value = process.env[name];
  if (!value) throw new Error(`Set ${name} before running this example`);
  return value;
};
const baseUrl = required('QFP_BASE_URL').replace(/\/$/, '');
if (!/^https:\/\//.test(baseUrl)) throw new Error('Use your assigned HTTPS gateway');
const token = required('QFP_ACCESS_TOKEN');
const segment = value => encodeURIComponent(value);
async function request(method, path, body, key) {
  const headers = { Authorization: `Bearer ${token}`, 'API-Version': '1.0.0', Accept: 'application/json' };
  if (key) headers['Idempotency-Key'] = key;
  const multipart = body instanceof FormData;
  if (body !== undefined && !multipart) headers['Content-Type'] = 'application/json';
  const response = await fetch(baseUrl + path, {
    method, headers, body: body === undefined ? undefined : multipart ? body : JSON.stringify(body),
    signal: AbortSignal.timeout(30_000), redirect: 'error',
  });
  const text = await response.text();
  const data = text && response.headers.get('content-type')?.includes('json') ? JSON.parse(text) : text || null;
  if (!response.ok) {
    const error = new Error(`HTTP ${response.status}`);
    Object.assign(error, { status: response.status, data, headers: response.headers });
    throw error;
  }
  return { status: response.status, data };
}

listWebhooks

List the organisation's webhook registrations. API Reference · Integration guide

GET /api/webhooks

Parameter	Location	Required
`API-Version`	header	Yes
`page`	query	No
`size`	query	No

const body = undefined;
const result = await request('GET', '/api/webhooks', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 400, 401, 500.

Example 200 (default); see the reference for other outcomes.

{
  "content": [
    {
      "id": "9f2a1c44-6e3b-4f8a-9d21-7c5e0b8a4d13",
      "url": "https://bank.example.com/quant/events",
      "status": "ACTIVE",
      "signatureScheme": "HMAC_SHA256",
      "eventTypes": [
        "account.provisioned",
        "transaction.confirmed"
      ],
      "createdAt": "2026-08-28T09:15:11.584Z",
      "updatedAt": "2026-08-28T09:15:11.584Z"
    },
    {
      "id": "3c8d5b21-9a47-4e60-b1f3-6d2a8e4c7f90",
      "url": "https://bank.example.com/quant/approvals",
      "status": "SUSPENDED",
      "signatureScheme": "JWS_ES256",
      "eventTypes": [
        "approval.requested"
      ],
      "suspendedAt": "2026-08-27T14:02:19.331Z",
      "createdAt": "2026-08-26T11:40:02.117Z",
      "updatedAt": "2026-08-27T14:02:19.331Z"
    }
  ],
  "page": 0,
  "size": 20,
  "totalElements": 2,
  "totalPages": 1
}

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

registerWebhook

POST /api/webhooks

Parameter	Location	Required
`API-Version`	header	Yes
`Idempotency-Key`	header	Yes

Request body: hmac

{
  "url": "https://bank.example.com/quant/events",
  "eventTypes": [
    "transaction.confirmed",
    "transaction.failed"
  ],
  "signatureScheme": "HMAC_SHA256"
}

Request body: jws

{
  "url": "https://bank.example.com/quant/events-jws",
  "eventTypes": [
    "approval.requested"
  ],
  "signatureScheme": "JWS_ES256"
}

const body = {
  "url": "https://bank.example.com/quant/events",
  "eventTypes": [
    "transaction.confirmed",
    "transaction.failed"
  ],
  "signatureScheme": "HMAC_SHA256"
};
const result = await request('POST', '/api/webhooks', body, required('QFP_IDEMPOTENCY_KEY'));
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 201, 400, 401, 409, 500.

Example 201 (hmac); see the reference for other outcomes.

{
  "id": "9f2a1c44-6e3b-4f8a-9d21-7c5e0b8a4d13",
  "url": "https://bank.example.com/quant/events",
  "status": "ACTIVE",
  "signatureScheme": "HMAC_SHA256",
  "eventTypes": [
    "transaction.confirmed",
    "transaction.failed"
  ],
  "secret": "8Kd2ZqL0vXmB7nR4tYcJ1sWfA6gH3pE9uQ5xN0iVrTk",
  "createdAt": "2026-08-28T09:15:11.584Z",
  "updatedAt": "2026-08-28T09:15:11.584Z"
}

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

getWebhook

Read one webhook registration. API Reference · Integration guide

GET /api/webhooks/{id}

Parameter	Location	Required
`API-Version`	header	Yes
`id`	path	Yes

const body = undefined;
const result = await request('GET', '/api/webhooks/' + encodeURIComponent('<id>') + '', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 401, 404, 500.

Example 200 (active); see the reference for other outcomes.

{
  "id": "9f2a1c44-6e3b-4f8a-9d21-7c5e0b8a4d13",
  "url": "https://bank.example.com/quant/events",
  "status": "ACTIVE",
  "signatureScheme": "HMAC_SHA256",
  "eventTypes": [
    "account.provisioned",
    "transaction.confirmed"
  ],
  "createdAt": "2026-08-28T09:15:11.584Z",
  "updatedAt": "2026-08-28T09:15:11.584Z"
}

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

updateWebhook

Change a registration's status or subscribed event types. API Reference · Integration guide

PATCH /api/webhooks/{id}

Parameter	Location	Required
`API-Version`	header	Yes
`id`	path	Yes
`Idempotency-Key`	header	Yes

Request body: statusOnly

{
  "status": "INACTIVE"
}

Request body: resubscribe

{
  "status": "ACTIVE",
  "eventTypes": [
    "transaction.confirmed",
    "transaction.failed",
    "account.provisioned"
  ]
}

const body = {
  "status": "INACTIVE"
};
const result = await request('PATCH', '/api/webhooks/' + encodeURIComponent('<id>') + '', body, required('QFP_IDEMPOTENCY_KEY'));
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 400, 401, 404, 409, 500.

Example 200 (updated); see the reference for other outcomes.

{
  "id": "9f2a1c44-6e3b-4f8a-9d21-7c5e0b8a4d13",
  "url": "https://bank.example.com/quant/events",
  "status": "ACTIVE",
  "signatureScheme": "HMAC_SHA256",
  "eventTypes": [
    "account.provisioned",
    "transaction.confirmed",
    "transaction.failed"
  ],
  "createdAt": "2026-08-28T09:15:11.584Z",
  "updatedAt": "2026-08-28T10:41:53.902Z"
}

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

deleteWebhook

Delete a webhook registration. API Reference · Integration guide

DELETE /api/webhooks/{id}

Parameter	Location	Required
`API-Version`	header	Yes
`id`	path	Yes

const body = undefined;
const result = await request('DELETE', '/api/webhooks/' + encodeURIComponent('<id>') + '', body, undefined);
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 204, 401, 404, 500.

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

rotateSecret

Issue a new HMAC secret, keeping the previous one briefly valid. API Reference · Integration guide

POST /api/webhooks/{id}/secret/rotate

Parameter	Location	Required
`API-Version`	header	Yes
`id`	path	Yes
`Idempotency-Key`	header	Yes

const body = undefined;
const result = await request('POST', '/api/webhooks/' + encodeURIComponent('<id>') + '/secret/rotate', body, required('QFP_IDEMPOTENCY_KEY'));
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 400, 401, 404, 409, 500.

Example 200 (rotated); see the reference for other outcomes.

{
  "id": "9f2a1c44-6e3b-4f8a-9d21-7c5e0b8a4d13",
  "secret": "4rT9wKpZ2xCvB8nM6qLsD1fG7hJ3yU5aE0oI4uYtRbN",
  "previousSecretExpiresAt": "2026-08-29T09:15:11.584Z"
}

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.

sendTestDelivery

Send one signed test delivery now, and return the outcome. API Reference · Integration guide

POST /api/webhooks/{id}/test

Parameter	Location	Required
`API-Version`	header	Yes
`id`	path	Yes
`Idempotency-Key`	header	Yes

const body = undefined;
const result = await request('POST', '/api/webhooks/' + encodeURIComponent('<id>') + '/test', body, required('QFP_IDEMPOTENCY_KEY'));
console.log(result.status, result.data);

Replace angle-bracket placeholders before calling. Persist any idempotency key with the business instruction.

Potential responses

Documented statuses: 200, 400, 401, 404, 409, 500.

Example 200 (delivered); see the reference for other outcomes.

{
  "eventId": "7c31d6b0-4f2e-4a8c-9b15-8d0a3e6c2f47",
  "webhookId": "9f2a1c44-6e3b-4f8a-9d21-7c5e0b8a4d13",
  "status": "DELIVERED",
  "attempts": 1
}

For CSV/download endpoints, the response may be text rather than JSON. The request helper preserves that distinction.