Skip to main content
WEBHOOK
Fires once, right after a payment intent is created with POST /payments/payment-intent. The intent is pending at this point.

​
Body

The body carries metadata about the event, not the entity itself. Use entityId to fetch the current state with GET /payments/payment-intent/{paymentIntentId}, and dedupe on eventId since deliveries are at-least-once and unordered.

​
Authentication

Every delivery is signed with a slash-webhook-signature header. Verify it against either of Slash’s public keys before trusting the payload; see Webhook Signing for the verification steps and a code sample. Respond with any 2xx within 10 seconds to acknowledge; anything else is retried.

Authorizations

​
X-API-Key
string
header
required

API key authentication for public API requests.

Keys come in two flavors:

  • Legal-entity-scoped keys are pinned to a single legal entity. Minted via the dashboard under a specific entity; every request acts on that entity.
  • User-scoped keys are pinned to a user and span every legal entity that user has access to. Every request made with a user-scoped key (except GET /legal-entity, which lists the legal entities the user can access) must include an x-legal-entity header naming the legal entity the request is operating on. Requests without the header are rejected with 400. The authenticated user must have an active permission role on the supplied legal entity, otherwise the request is rejected with 403.

Body

application/json
​
event
enum<string>
required

The event type.

Available options:
payments.payment_intent.created
​
eventId
string
required

Unique id of the event. Use it as an idempotency key.

​
entityId
string
required

The id of the payment intent that triggered the event.

​
eventTimestamp
string<date-time>
required

When the event occurred.

Response

200

Return any 2xx status to acknowledge receipt. Non-2xx responses are retried.