Webhooks - Slash

Webhooks notify your integration when a Slash resource changes. Register a webhook endpoint, then see Webhook event types for the card, transaction, and expense-report events cataloged here, grouped by resource with the payload for each type. Checkout and acquiring-refund events remain documented with their respective API surfaces.

Delivery envelope

Webhook bodies identify the event and changed resource. They do not embed the resource’s current state:

{
  "event": "card.update",
  "eventId": "public_webhook_notification_...",
  "entityId": "c_...",
  "eventTimestamp": "2026-08-18T01:00:00.000Z"
}

Process every delivery in this order:

Verify the signature against the exact raw body.
Deduplicate by eventId.
Route handling by event.
Use entityId to retrieve the resource’s current state when a corresponding GET endpoint is available.

Deliveries can be duplicated or arrive after a retry. Store the event or resource id, make processing idempotent, and fetch current state instead of assuming every intermediate event will arrive in order.

Signature verification

Every delivery includes slash-webhook-signature. Verify its base64 value with Slash’s public RSA key and SHA-256 over the raw request body. Do not verify a parsed and re-serialized JSON body.

⌘I