Skip to main content
Webhooks notify your integration when a Slash resource changes. Register a webhook endpoint, then see Webhook event types for the card, transaction, and expense-report events cataloged here, grouped by resource with the payload for each type. Checkout and acquiring-refund events remain documented with their respective API surfaces.

​
Delivery envelope

Webhook bodies identify the event and changed resource. They do not embed the resource’s current state:
Process every delivery in this order:
  1. Verify the signature against the exact raw body.
  2. Deduplicate by eventId.
  3. Route handling by event.
  4. Use entityId to retrieve the resource’s current state when a corresponding GET endpoint is available.
Deliveries can be duplicated or arrive after a retry. Store the event or resource id, make processing idempotent, and fetch current state instead of assuming every intermediate event will arrive in order.

​
Signature verification

Every delivery includes slash-webhook-signature. Verify its base64 value with SHA-256 over the raw request body and either public RSA key. Deliveries use the current key through October 4, 2026 and the new key starting October 5, 2026, so a signature that matches either key is valid during the transition. Do not verify a parsed and re-serialized JSON body.