Deposit webhooks

Process signed deposit.updated events without crediting the same transaction twice.

EVENTdeposit.updated

Sent to the webhookUrl supplied when creating a deposit. Each event contains a full transaction snapshot in data.

x-event-type: deposit.updated
x-timestamp: <Unix timestamp in milliseconds>
x-signature: <hmac-sha256-hex>

Verify before processing

Read the raw body without reserializing it.
Require the header timestamp to be within five minutes.
Compute hex HMAC-SHA256 over x-timestamp + "." + rawBody using your client webhook secret. Compare signatures in constant time.
Persist the event in a durable inbox before returning 2xx.

Payload after settlement

{
  "version": 1,
  "eventId": "019e0000-0000-7000-8000-000000000005",
  "type": "deposit.updated",
  "timestamp": "2026-10-11T12:00:00Z",
  "data": {
    "transactionId": "019e0000-0000-7000-8000-000000000003",
    "externalId": "deposit_42",
    "quoteId": "019e0000-0000-7000-8000-000000000001",
    "status": "success",
    "currency": "USD",
    "creditAmountCents": 3991,
    "creditStatus": "available",
    "walletTransactionId": "019e0000-0000-7000-8000-000000000004",
    "holdReleaseAt": null,
    "steamTradeOfferId": "7193849201",
    "botSteamId": "76561198000000002",
    "items": [
      {
        "itemId": "019e0000-0000-7000-8000-000000000002",
        "inventoryAssetId": "53273940796",
        "marketHashName": "AK-47 | Aquamarine Revenge (Field-Tested)",
        "phase": null,
        "amount": 1,
        "imageUrl": null,
        "sellable": true,
        "creditAmountCents": 3991,
        "unavailableReason": null
      }
    ],
    "failureCode": null,
    "revision": 4,
    "updatedAt": "2026-10-11T12:00:00Z"
  }
}

Deduplication and recovery

Deduplicate by eventId; ignore older data.revision values. Delivery retries retain the event ID and use a fresh signed header timestamp.

Use GET /v1/deposits/offers/{externalId} as bounded recovery when callbacks are delayed. Do not create a second deposit.