Skip to main content
POST
cURL
Use Start webhook verification and poll its status when you want a durable asynchronous result. This route keeps its synchronous behavior and waits for the receiver. Verify your endpoint after creating it or changing its URL. The request needs the one-time verification_token, and your receiver must answer the signed challenge with a 2xx response. The token must match the endpoint and be less than 24 hours old. Until verification succeeds, the endpoint receives no events.

Parameters

The challenge

0xinsider sends one signed POST to the endpoint’s stored url. It follows no redirects, allows 10 seconds for your answer, and never reads your response body. Check the signature the way you check a delivery, and reject a timestamp more than 5 minutes old. A staged rotation does not change this: the challenge carries one signature, from the current secret.

Example

When it fails

A success sets verified_at, sets status to active, and resets failure_count to 0.

What it does not do

  • Refresh an expired token. Only a url change through Update a webhook issues a new one, and sending the URL the endpoint already has does not count as a change.
  • Read an Idempotency-Key. This route does not take one, so a retry sends the challenge again.
  • Return signing_secret. You have it from create, or from the response that rotated it.
  • Repeat your destination’s response body or its resolved IP address in the error. Neither reaches you or the logs.

Authorizations

Authorization
string
header
required

Legacy default or named integration API key, or OAuth 2.1 access token, in the Authorization header as Bearer oxi_sk_live_... or Bearer oxi_at_.... Default keys retain full access; integration keys are limited to their approved read, webhooks, export and usage scopes and expire within 90 days. All credentials share the owner's account limits. Data calls require an active Pro subscription and return live data. A 401 carries WWW-Authenticate: Bearer resource_metadata="https://api.0xinsider.com/.well-known/oauth-protected-resource" (RFC 6750 section 3, RFC 9728).

Headers

X-Query-Validation
enum<string>

Opt into strict query-name validation. The default is compatible: unknown names are ignored and reported in X-Query-Ignored. With strict, an unknown name returns 400 bad_request with error.reason unknown_query_parameter before the handler runs, including when its percent escape is incomplete.

Available options:
strict

Path Parameters

id
integer<int64>
required

Webhook endpoint id owned by the authenticated API key user.

Body

application/json

One-time verification token for the pending webhook.

verification_token
string
required

The one-time token returned on create or on a url change. It is necessary but not sufficient: the destination must also answer the signed webhook.verification challenge with a 2xx.

Response

Webhook destination

object
string
required
Allowed value: "webhook"
data
object
required
meta
object
required