iBanFirst

iBanFirst Webhook subscriptions API

**1. WHAT IS A WEBHOOK ?** - Webhooks are events based real-time notifications providing updates on transactions and removing the need for periodic polling. - Webhook notifications are sent as HTTPS POST requests to a URL of your choice. **2. WEBHOOK SUBSCRIPTIONS** - Each webhook subscription allows you to receive notifications for one or more event types : - **Outgoing payment :**`PAYMENT_PLANIFIED` `PAYMENT_FINALIZED` `PAYMENT_WAITING_SIGNATURE` `PAYMENT_AWAITING_CONFIRMATION` `PAYMENT_CANCELED` `PAYMENT_BLOCKED` `PAYMENT_WAITING_JUSTIFICATION` `PAYMENT_INCOMING` - **Spot trade** : `TRADE_PLANIFIED` `TRADE_FINALIZED` `TRADE_CANCELED` `TRADE_BLOCKED` - You may have up to 10 active subscriptions at the same time. **3. IMPLEMENTATION** - **Delivery and retries** - Webhook notifications may not be delivered in order, your implementation should not assume sequential delivery. - If a notification delivery fails (HTTP status code 400 or 500), it will be retried twice, with a 60-second delay between attempts. This results in a maximum of three delivery attempts per event. - **Acknowledgement** - We recommend responding with a HTTP `204` code (No Content) to acknowledge receipt of a notification. - **Whitelisting** - To ensure webhook notifications reach your URL, you may need to whitelist the following IP (production and demo): **51.158.86.1**. **4. SECURITY** - Each webhook notification includes an HMAC-256 signature in the request header to let you **validate its authenticity**. - To verify the signature, recontruct the signed message by concatenating the exact timestamp and request raw body as received : `x-ibanfirst-timestamp.{Body}`. - Compute an HMAC-SHA256 hash of this string using the subscription secret key and compare the result with the `x-ibanfirst-signature` provided in the notification header. - You must **reject** the notification if the signatures do not match. - Recommended best practices : - Always validate the signature before processing any webhook notification. - Webhook notification payloads must be stored on a private server to protect sensitive data. **5. WEBHOOK NOTIFICATION CONTENT** Notifications contain the relevant object as described in each reconciliation service. - [Get payment details](https://docs.ibanfirst.com/api/clientapi/payments/paths/~1payments~1%7Bid%7D/get) - [Get trade detail](https://docs.ibanfirst.com/api/clientapi/trades/paths/~1trades~1%7Bid%7D/get) ```json { "event": event_label, "payload": { see get payment details, get trade details }, "webhookId": "e35b6e8d-67ef-4973-945d-c3190a60d0aa" } ```

Documentation GitHub OpenAPI

Business capability

Webhook & Event Subscription Management BC-4270.80

Operations 7

POST /webhooks Create webhook subscription #

GET /webhooks Get webhook subscriptions list #

GET /webhooks/{webhookId} Get webhook subscription details #

PATCH /webhooks/{webhookId} Update webhook subscription #

DELETE /webhooks/{webhookId} Cancel webhook subscription #

POST /webhooks/{webhookId}/rotate-secret Rotate secret #

GET /webhooks/{webhookId}/failed-notifications Get failed notifications #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/ibanfirst-webhook-subscriptions-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  version: 1.6.0
  title: iBanFirst Webhook subscriptions API
  description: iBanFirst API for cross-border payments, FX trades, account management, beneficiaries, and webhooks.
servers:
- url: https://api-demo.ibanfirst.com/api
security:
- X-WSSE: []
tags:
- name: Webhook Subscriptions
  description: '**1.'
paths:
  /webhooks:
    post:
      summary: Create webhook subscription
      tags:
      - Webhook Subscriptions
      description: 'You can subscribe to one or more events.


        **Note :** Please save the issued secret as it cannot be retrieved again.'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - events
              - url
              properties:
                events:
                  $ref: '#/components/schemas/events'
                url:
                  $ref: '#/components/schemas/url'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhookId:
                    $ref: '#/components/schemas/webhookId'
                  events:
                    $ref: '#/components/schemas/events'
                  secret:
                    type: string
                    pattern: ^[A-Za-z0-9]{32,64}$
                  url:
                    $ref: '#/components/schemas/url'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postWebhooks
      x-operation-id-source: derived
    get:
      summary: Get webhook subscriptions list
      tags:
      - Webhook Subscriptions
      description: Retrieve the list of your webhook subscriptions.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: array
                description: An array containing a list of your webhooks and details.
                items:
                  $ref: '#/components/schemas/Webhook'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: getWebhooks
      x-operation-id-source: derived
  /webhooks/{webhookId}:
    get:
      summary: Get webhook subscription details
      tags:
      - Webhook Subscriptions
      description: Retrieve the details of a specific webhook subscription.
      parameters:
      - name: webhookId
        in: path
        description: 'The ID of the webhook subscription.

          '
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Webhook'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: getWebhooksByWebhookId
      x-operation-id-source: derived
    patch:
      summary: Update webhook subscription
      tags:
      - Webhook Subscriptions
      description: You can update the list of subscribed events and/or the url notifications are sent to.
      parameters:
      - name: webhookId
        in: path
        description: 'The ID of the webhook subscription you want to update.

          '
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                events:
                  $ref: '#/components/schemas/events'
                url:
                  $ref: '#/components/schemas/url'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhookId:
                    $ref: '#/components/schemas/webhookId'
                  events:
                    $ref: '#/components/schemas/events'
                  url:
                    $ref: '#/components/schemas/url'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: patchWebhooksByWebhookId
      x-operation-id-source: derived
    delete:
      summary: Cancel webhook subscription
      tags:
      - Webhook Subscriptions
      description: Cancel a webhook subscription to stop receiving notifications.
      parameters:
      - name: webhookId
        in: path
        description: 'The ID of the webhook subscription you want to cancel.

          '
        required: true
        schema:
          type: string
      responses:
        '204':
          description: OK
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: deleteWebhooksByWebhookId
      x-operation-id-source: derived
  /webhooks/{webhookId}/rotate-secret:
    post:
      summary: Rotate secret
      tags:
      - Webhook Subscriptions
      description: Ask for a new secret for a specific webhook subscription.
      parameters:
      - name: webhookId
        in: path
        description: 'The ID of the webhook subscription.

          '
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhookId:
                    $ref: '#/components/schemas/webhookId'
                  events:
                    $ref: '#/components/schemas/events'
                  secret:
                    type: string
                    pattern: ^[A-Za-z0-9]{32,64}$
                  url:
                    $ref: '#/components/schemas/url'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: postWebhooksByWebhookIdRotateSecret
      x-operation-id-source: derived
  /webhooks/{webhookId}/failed-notifications:
    get:
      summary: Get failed notifications
      tags:
      - Webhook Subscriptions
      description: Retrieve the list of failed notifications for a given subscription.
      parameters:
      - name: webhookId
        in: path
        description: 'The ID of the webhook subscription.

          '
        required: true
        schema:
          type: string
      - name: fromDate
        in: query
        description: 'The starting date to search for failed notifications.

          '
        required: false
        schema:
          type: string
          format: YYYY-MM-DD
      - name: toDate
        in: query
        description: 'The ending date to search for failed notifications.

          '
        required: false
        schema:
          type: string
          format: YYYY-MM-DD
      - name: page
        in: query
        description: 'Index of the page.

          '
        required: false
        schema:
          type: string
          default: '1'
      - name: per_page
        in: query
        description: Number of items returned per page.
        required: false
        schema:
          type: string
          default: '50'
      - name: sort
        in: query
        description: "Notifications are sorted by creation date. \n"
        required: false
        schema:
          type: string
          enum:
          - ASC
          - DESC
          default: DESC
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  failedNotifications:
                    type: array
                    items:
                      $ref: '#/components/schemas/webhookFailedNotification'
                  totalCount:
                    description: Total count of failed notifications
                    type: string
                    example: '10'
                  page:
                    description: 'Index of the page.

                      '
                    type: string
                    example: '1'
                  perPage:
                    description: 'Number of items returned per page.

                      '
                    type: string
                    example: '50'
                  totalPages:
                    description: 'Number of pages.

                      '
                    type: string
                    example: '10'
        default:
          description: ERROR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      operationId: getWebhooksByWebhookIdFailedNotifications
      x-operation-id-source: derived
components:
  schemas:
    url:
      type: string
      description: 'Notifications are sent to this url.

        '
      pattern: ^(https?:\/\/)[^\s/$.?#].[^\s]*$
      example: https:\www.notification.com
    events:
      type: array
      items:
        type: string
        enum:
        - PAYMENT_CREATED
        - PAYMENT_PLANIFIED
        - PAYMENT_FINALIZED
        - PAYMENT_WAITING_SIGNATURE
        - PAYMENT_AWAITING_CONFIRMATION
        - PAYMENT_CANCELED
        - PAYMENT_BLOCKED
        - PAYMENT_WAITING_JUSTIFICATION
        - PAYMENT_INCOMING
        - TRADE_PLANIFIED
        - TRADE_FINALIZED
        - TRADE_CANCELED
        - TRADE_BLOCKED
    notificationContent:
      type: object
      properties:
        payload:
          description: Content of the notification, see get payment details, get trade details
        eventType:
          type: string
          description: Event that triggered the notification.
        webhookId:
          $ref: '#/components/schemas/webhookId'
    Webhook:
      type: object
      description: 'Representation of a webhook subscription.

        '
      properties:
        webhookId:
          $ref: '#/components/schemas/webhookId'
        events:
          description: 'List of subscribed events.

            '
          type: array
          items:
            $ref: '#/components/schemas/events'
        url:
          $ref: '#/components/schemas/url'
    Error:
      type: object
      description: 'Representation of an error.

        '
      properties:
        errorCode:
          type: number
          format: int
          description: 'The code referring the error.

            '
        errorType:
          type: string
          description: 'A short description identifying a general category for the error that occurred.

            '
        errorMessage:
          type: string
          description: Error description.
        link:
          type: string
          description: 'An hyperlink to access the page that describes more accurately the error.

            '
    webhookId:
      type: string
      pattern: ^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$
      example: cf16243d-7e0a-4a5b-b996-ba7018201e30
      description: 'ID of the webhook subscription.

        '
    webhookFailedNotification:
      type: object
      properties:
        id:
          description: Unique ID of a notification
          type: string
          pattern: ^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$
          example: cf16243d-7e0a-4a5b-b996-ba7018201e30
        notificationContent:
          $ref: '#/components/schemas/notificationContent'
        errorMessage:
          description: ''
          type: string
        httpStatusCode:
          description: ''
          type: string
          example: '404'
        failedAt:
          type: string
          pattern: ''
          description: ''
        retryCount:
          description: ''
          type: integer
  securitySchemes:
    X-WSSE:
      type: apiKey
      in: header
      name: X-WSSE
      description: 'X-WSSE token-based authentication. The header value must be computed fresh for every request (tokens expire in ~5 minutes).


        Header value format:

        ```

        UsernameToken Username="<username>", PasswordDigest="<digest>", Nonce="<nonce_b64>", Created="<timestamp>"

        ```


        Algorithm:

        1. Generate a random nonce: ≥ 32 lowercase hex characters.

        2. Get current UTC timestamp in ISO 8601: `YYYY-MM-DDTHH:MM:SSZ`.

        3. Compute `PasswordDigest = Base64( SHA-1( nonce_bytes + created_bytes + secret_bytes ) )` — SHA-1 over the raw UTF-8 bytes concatenated in that order, result must be the binary digest before Base64 encoding.

        4. Compute `Nonce = Base64( nonce_utf8_bytes )`.


        See the `info.description` field at the top of this spec for full code samples in Python, JavaScript, PHP, Java, and Go.'