Webhook events — ANONPAY Docs

payment_change

POSTyour webhook URL

An incoming payment was observed.

Sent to the transaction's webhook URL when a payment is seen but the transaction is not complete yet. It can repeat as more arrives or confirms.

X-Signature: t=<unix>,v1=<hex>, where the hex is HMAC-SHA256 of "<t>.<raw body>" keyed with the transaction's private_key. Reject timestamps more than 300 seconds from your clock.

Any 2xx means delivered. Most 4xx answers stop the retries; answer 429 or 503 to be asked again later, and Retry-After is honoured up to one hour. Delivery is at-least-once, so make the handler idempotent.

Headers

X-Eventstring: The event name, the same as event in the body.
payment_change
X-SignaturestringRequired: t=<unix seconds>,v1=<hex>: an HMAC-SHA256 of the timestamp and the raw body, keyed with the transaction's or withdrawal's private_key.

Body

eventstring

payment_changecompletedwithdrawal.completed

timestampunix time

private_keystring

The key returned when the transaction or withdrawal was created. Delivered for backwards compatibility; it proves the sender knew a shared secret but cannot prove freshness. Prefer X-Signature.

transaction_idstring

On payment_change and completed.

paymentobject or null

10 child attributes

addressstring: Receiving address, or PayPal email.
currencystring: What the buyer actually pays in.
topaydecimal string: Quoted at the currency's practical precision, rounded up so the seller is never short-changed.
paiddecimal string: Observed so far. Updated by the settlement job.
ratedecimal string: transaction-currency → payment-currency, locked in at mint time.
confirmationsinteger or null: Crypto only. -1 means nothing observed yet.
confirmations_neededinteger or null: Crypto only.
overpaiddecimal string: Present only when the buyer paid more than topay.
gsboolean: PayPal only — Goods & Services accepted.
ffboolean: PayPal only — Friends & Family accepted.

Body

{
  "event": "payment_change",
  "timestamp": 1753919700,
  "private_key": "a3f9d0e1c2b4a6f8e0d2c4b6a8f0e2d4",
  "transaction_id": "9c1f0b7a4e2d8f6a3b5c7d9e1f0a2b4c",
  "payment": {
    "address": "bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq",
    "currency": "btc",
    "topay": "0.00021",
    "paid": "0.00021",
    "rate": "0.0000105",
    "confirmations": 1,
    "confirmations_needed": 6
  }
}

completed

POSTyour webhook URL

The transaction reached its completion threshold.

Sent once the amount paid, after confirmations, reaches the transaction's price less your completion threshold. Signed like every event.

Headers

X-Eventstring: The event name, the same as event in the body.
completed
X-SignaturestringRequired: t=<unix seconds>,v1=<hex>: an HMAC-SHA256 of the timestamp and the raw body, keyed with the transaction's or withdrawal's private_key.

Body

eventstring

payment_changecompletedwithdrawal.completed

timestampunix time

private_keystring

The key returned when the transaction or withdrawal was created. Delivered for backwards compatibility; it proves the sender knew a shared secret but cannot prove freshness. Prefer X-Signature.

transaction_idstring

On payment_change and completed.

paymentobject or null

10 child attributes

addressstring: Receiving address, or PayPal email.
currencystring: What the buyer actually pays in.
topaydecimal string: Quoted at the currency's practical precision, rounded up so the seller is never short-changed.
paiddecimal string: Observed so far. Updated by the settlement job.
ratedecimal string: transaction-currency → payment-currency, locked in at mint time.
confirmationsinteger or null: Crypto only. -1 means nothing observed yet.
confirmations_neededinteger or null: Crypto only.
overpaiddecimal string: Present only when the buyer paid more than topay.
gsboolean: PayPal only — Goods & Services accepted.
ffboolean: PayPal only — Friends & Family accepted.

Body

{
  "event": "completed",
  "timestamp": 1753920000,
  "private_key": "a3f9d0e1c2b4a6f8e0d2c4b6a8f0e2d4",
  "transaction_id": "9c1f0b7a4e2d8f6a3b5c7d9e1f0a2b4c",
  "payment": {
    "address": "bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq",
    "currency": "btc",
    "topay": "0.00021",
    "paid": "0.00021",
    "rate": "0.0000105",
    "confirmations": 6,
    "confirmations_needed": 6
  }
}

withdrawal.completed

POSTyour webhook URL

A payout was broadcast.

Signed with the withdrawal's private_key, not the transaction's.

Headers

X-Eventstring: The event name, the same as event in the body.
withdrawal.completed
X-SignaturestringRequired: t=<unix seconds>,v1=<hex>: an HMAC-SHA256 of the timestamp and the raw body, keyed with the transaction's or withdrawal's private_key.

Body

eventstring: payment_changecompletedwithdrawal.completed
timestampunix time
private_keystring: The key returned when the transaction or withdrawal was created. Delivered for backwards compatibility; it proves the sender knew a shared secret but cannot prove freshness. Prefer X-Signature.
withdrawal_idstring: On withdrawal.completed.
crypto_transaction_idstring or null: On withdrawal.completed.

Body

{
  "event": "withdrawal.completed",
  "timestamp": 1753923600,
  "private_key": "e5d4c3b2a1908f7e6d5c4b3a29180f7e",
  "withdrawal_id": "7b9d0f2a4c6e8b0d2f4a6c8e0b2d4f6a",
  "crypto_transaction_id": "4f3e2d1c0b9a8776655443322110ffee"
}