Register a webhook
The URL must be public https. Private, loopback and link-local addresses are refused, and redirects are not followed.
Every delivery carries X-Rivo-Signature in the form t=<unix>,v1=<hmac>, where the HMAC is SHA-256 over the string "<t>.<body>" keyed with your secret. Verify it and reject anything with a timestamp older than five minutes.
Failed deliveries retry with exponential backoff and are abandoned after eight attempts. Return any 2xx to acknowledge.
The secret is shown once here and never again. Requires the write scope. Maximum five endpoints.
Body parameters
urlstringrequiredPublic https URL.
eventsstring[]Event types to receive. Omit or pass an empty array for all of them.
Response
DELETE /v1/webhooks/{id} removes an endpoint and its pending deliveries.
curl -X POST https://api.rivo.markets/v1/webhooks \
-H "Authorization: Bearer rivo_live_..." \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/hooks/rivo",
"events": [
"trade.followed",
"copy.executed"
]
}'import requests
r = requests.post(
"https://api.rivo.markets/v1/webhooks",
headers={"Authorization": "Bearer rivo_live_..."},
json={
"url": "https://example.com/hooks/rivo",
"events": ["trade.followed", "copy.executed"],
},
)
print(r.json()["data"])const res = await fetch("https://api.rivo.markets/v1/webhooks", {
method: "POST",
headers: {
Authorization: "Bearer rivo_live_...",
"Content-Type": "application/json",
},
body: JSON.stringify({
url: "https://example.com/hooks/rivo",
events: ["trade.followed", "copy.executed"],
}),
});
const { data } = await res.json();response
{
"success": true,
"data": {
"id": "e11a...4c90",
"url": "https://example.com/hooks/rivo",
"events": ["trade.followed", "copy.executed"],
"secret": "9f1c8b2e... (shown once)"
}
}