> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slash.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Event types, signature verification, and idempotent handling.

Webhooks notify your integration when a Slash resource changes. Register a
webhook endpoint, then see [Webhook event types](/docs/v2/webhooks/event-types)
for the card, transaction, and expense-report events cataloged here, grouped by
resource with the payload for each type. Checkout and acquiring-refund events
remain documented with their respective API surfaces.

## Delivery envelope

Webhook bodies identify the event and changed resource. They do not embed the
resource's current state:

```json theme={null}
{
  "event": "card.update",
  "eventId": "public_webhook_notification_...",
  "entityId": "c_...",
  "eventTimestamp": "2026-08-18T01:00:00.000Z"
}
```

Process every delivery in this order:

1. Verify the signature against the exact raw body.
2. Deduplicate by `eventId`.
3. Route handling by `event`.
4. Use `entityId` to retrieve the resource's current state when a corresponding
   GET endpoint is available.

Deliveries can be duplicated or arrive after a retry. Store the event or
resource id, make processing idempotent, and fetch current state instead of
assuming every intermediate event will arrive in order.

## Signature verification

Every delivery includes `slash-webhook-signature`. Verify its base64 value with
Slash's [public RSA key](/api-reference/public-rsa-key) and SHA-256 over the raw
request body. Do not verify a parsed and re-serialized JSON body.