Syntage Webhook Requests API
Webhook requests are delivery attempts from Syntage to a webhook endpoint. Use them to monitor delivery status, inspect failed deliveries, and connect an event to the endpoint that received it.
Webhook requests are delivery attempts from Syntage to a webhook endpoint. Use them to monitor delivery status, inspect failed deliveries, and connect an event to the endpoint that received it.
openapi: 3.0.2
info:
version: '2020-06-28'
title: Syntage Accounts Payable Insight Webhook Requests API
contact:
name: Email
email: support@syntage.com
description: "# Introduction\n\nThe Syntage API is organized around [REST](https://en.wikipedia.org/wiki/Representational_State_Transfer).\nOur API has predictable resource-oriented URLs, accepts form-encoded request bodies, returns [JSON-LD](https://json-ld.org) responses, and uses standard HTTP response codes, authentication, and verbs.\n\n# Environments\n\n| Name | Description | Base URL |\n|------|-------------|----------|\n| **Sandbox** | The Sandbox environment is dedicated to development and testing. In this environment, no real taxpayer credentials are required and all interaction with the SAT is simulated generating life-like data, allowing you to pull test data from all endpoints. | https://api.sandbox.syntage.com |\n| **Production** | The Production environment is dedicated to live applications with real connections to the SAT. In this environment, real taxpayer credentials are required, and you will pull real fiscal data directly from the SAT. | https://api.syntage.com |\n\nEach environment has a different API Key for [authentication](#section/Authentication).\n\n# Request IDs\n\nEach API request has an associated request identifier.\nYou can find this value in the response headers, under `X-Request-ID`:\n\n```curl\ncurl -i https://api.syntage.com\nHTTP/1.1 200 OK\nDate: Sun, 29 Nov 2020 19:21:21 GMT\nX-Request-ID: Root=1-6532dcae-169bf139354cd48959f55c55\n```\n\nIf you need to contact us about a specific request, providing the request identifier will ensure the fastest possible resolution.\n\n# Rate Limiting\n\nOur API employs a number of safeguards against bursts of incoming traffic to help maximize its stability.\nThe returned HTTP headers of any API request show your current rate limit status:\n\n```curl\ncurl -i https://api.syntage.com\nHTTP/1.1 200 OK\nDate: Sun, 29 Nov 2020 19:21:21 GMT\nX-RateLimit-Limit: 60\nX-RateLimit-Remaining: 56\nX-RateLimit-Reset: 1606678044\n```\n\n| Header Name | Description |\n|-----------------------|------------------------------------------------------------------------------|\n| X-RateLimit-Limit | The maximum number of requests you're permitted to make. |\n| X-RateLimit-Remaining | The number of requests remaining in the current rate limit window. |\n| X-RateLimit-Reset | The time at which the current rate limit window resets in UTC epoch seconds. |\n\nIf you exceed the rate limit, a [429 Too Many Requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429) response is returned:\n\n```http\nHTTP/1.1 429 Too Many Requests\nDate: Sun, 29 Nov 2020 19:21:21 GMT\nX-RateLimit-Limit: 60\nX-RateLimit-Remaining: 0\nX-RateLimit-Reset: 1606678044\n```\n\nWe may reduce limits to prevent abuse, or increase limits to enable high-traffic operations.\nYou can check your current limits in the [dashboard](https://app.syntage.com/settings/usage).\nTo request an increased rate limit, please [contact support](https://support.syntage.com/).\n# Pagination\nWhen issuing a GET request on a collection containing more than 1 page (e.g. [/events](#operation/ListEvent)), a collection is returned. Links to the first, the last, previous and the next page in the collection are displayed as well as the number of total items in the collection.\nAll endpoints that support this operation have a query parameter defined by:\n - `itemsPerPage` The number of items per page (default: 20, max: 1000)\n - `page` The collection page number\n\n```bash\n \"hydra:totalItems\": 1,\n \"hydra:view\": {\n \"@id\": \"/events?page=1\",\n \"@type\": \"hydra:PartialCollectionView\",\n \"hydra:first\": \"/events?page=1\",\n \"hydra:next\": \"/events?page=2\",\n \"hydra:last\": \"/events?page=3\"\n },\n```\n## Cursor Pagination\nCursor pagination is a technique used for navigating through large datasets efficiently. It allows you to retrieve a specific subset of results from a collection by using a cursor value that represents the position within the collection. The cursor serves as a reference point for fetching the next or previous set of results.\n### Benefits of Cursor Pagination:\n1. **Efficient Navigation:** Cursor pagination eliminates the need to fetch the entire dataset at once, making it more scalable and faster. You can retrieve data in smaller, manageable chunks based on the cursor values.\n2. **Consistent Results:** Each page of results in cursor pagination is stable and doesn't change even if new items are added or removed from the collection. This ensures that you get consistent and reliable results.\n3. **Flexibility:** Cursors can be used to navigate forwards and backwards in the collection without impacting performance.\n\n### How to Use Cursor Pagination:\nTo use cursor pagination with our API, follow these instructions:\n1. Make a request to retrieve the initial page of results. The response will be a JSON-LD document that includes a `hydra:next` attribute with the URI for the next page. The URI already includes the cursor attribute.\n2. To retrieve the next page of results, make a GET request to the URI provided in the `hydra:next` attribute. This URI will automatically include the cursor value for the next page.\n3. If you want to navigate to the previous page, you can use the `hydra:previous` attribute in the JSON-LD response. It will contain the URI for the previous page, including the cursor value.\n4. You can continue making requests to the `hydra:next` and `hydra:previous` URIs to navigate through the paginated results, based on your requirements.\nMake sure to update your request headers to include the necessary headers for JSON-LD content negotiation, such as `Accept: application/ld+json` or `Content-Type: application/ld+json`.\nBy following these instructions, you can effectively navigate through the paginated results using the cursor values provided in the `hydra:next` and `hydra:previous` attributes, without the need to manually include the cursor in your requests. This simplifies the pagination process and enhances the usability of our API.\n\n### Considerations About Cursor Pagination:\n\n - By default, the API uses offset-based pagination (except for a few endpoints that we will list below). If you want to switch to cursor pagination, you need to include an additional header in your request. Set the `X-Pagination-Style` header with the value `\"cursor\"` to enable cursor pagination. If not specified, the API will assume offset-based pagination.\n\n - After enabling cursor pagination, the API response will no longer include the `hydra:totalItems` field by default. Retrieving the total count can be resource intensive and impact response times, especially for large datasets. However, if you need the `hydra:totalItems` information, you can include an additional header in your request. Set the `X-Pagination-Enable-Partial` header with the value `0` to indicate that the response should include extra information, including the `hydra:totalItems` count. Please be aware that enabling this feature may impact API response times, as the backend needs to perform a count operation on the dataset.\n\nIf you require the `hydra:totalItems` count, please consider the potential impact on API response times.\n### Example\n```bash\n curl -i 'https://api.syntage.com/entities/{entityId}/invoices?itemsPerPage=10' \\\n --header 'Accept: application/ld+json' \\\n --header 'X-Api-Key: {apiKey}' \\\n --header 'X-Pagination-Style: cursor' \\\n --header 'X-Pagination-Enable-Partial: 0'\n```\n**Note:** We only support cursor pagination for the following endpoints:\n - `GET /entities/{entityId}/invoices`\n - `GET /entities/{entityId}/invoices/line-items`\n - `GET /entities/{entityId}/invoices/{invoiceId}/line-items`\n - `GET /invoices/{invoiceId}/line-items`\n - `GET /entities/{entityId}/invoices/payments`\n\nFeel free to reach out if you have any further questions or need additional assistance!\n\n# Property Filtering\nThe property filter adds the possibility to select the properties for GET operations.\nSyntax: `?properties[]=<property>&properties[<relation>][]=<property>`\nYou can add as many properties as you need. The following example shows how to select `paymentType` and `issuer.rfc` when fetching a list of invoices.\n```curl\n curl -i https://api.syntage.com/entities/{entityId}/invoices?properties[]=paymentType&properties[issuer]=rfc\n```\n# Filtering\n**Warning:** Collection endpoints only apply the filter query parameters documented for that endpoint. If you send an unsupported or misspelled filter query parameter, the API ignores it and processes the request as if that parameter was not sent.\n\n# API Versioning Guide\nGuidance on changes between versions.\n## Version: 2020-01-01 to 2020-06-28\n### **Invoice**\n_**Affected Endpoints:** `GET /invoices/{id}` and `GET /entities/{entityId}/invoices`_\n- The `amount` property has been removed from API responses. Use the `total` property instead.\n- Retrieval by invoice's `uuid` at `/invoices/{id}` is now removed. To retrieve an invoice, use the invoice's `id` at the specified endpoint. To find an invoice using its `uuid`, filter the invoice collection at `/entities/{entityId}/invoices?uuid[]={uuid}`.\n- Previously, the `@iri` property for an invoice pointed to the resource using `uuid`, like `/invoices/{uuid}`. Now, it points using its `id`, like `/invoices/{id}`.\n\n### **Entity (Formerly Link)**\n_**Affected Endpoint:** `GET /entities`_\n- Filtering entities by `status` is removed. Use `credential.status` instead. For example, utilize `GET /entities?credential.status[]=active` instead of `GET /entities?status[]=active`.\n\n### **Tax Return**\n_**Affected Endpoints:** `GET /tax-returns/{id}` and `GET /entities/{entityId}/tax-returns`_\n- Retrieval by tax return's `operationNumber` at `/tax-returns/{id}` is removed. To retrieve a tax return, use the tax return's `id` at the mentioned endpoint. To find a tax return using its `operationNumber`, filter the collection at `/entities/{entityId}/tax-returns?operationNumber[]={operationNumber}`.\n- Previously, the `@iri` property for a tax return pointed to the resource using `operationNumber`, like `/tax-returns/{operationNumber}`. Now, it directs to its `id`, like `/tax-returns/{id}`.\n\n### **Event**\n_**Affected Endpoints:** `GET /events` and `GET /events/{id}`_\n- For events associated to an `tax-return`, the `@iri` property now directs to `/tax-returns/{id}` instead of the previous `/tax-returns/{operationNumber}`.\n- For events associated to an `invoice`, the `@iri` property now directs to `/invoices/{id}` instead of the previous `/invoices/{uuid}`.\n\n### **Extraction**\n_**Affected Endpoints:** `GET /extractions` and `GET /extractions/{id}`_\n- The `periodFrom` property has been removed. Use `options.period.from` instead.\n- The `periodTo` property has been removed. Use `options.period.to` instead.\n\n### **File**\n_**Affected Endpoint:** `GET /file/{id}`_\n- For files associated to an `tax-return`, the `@iri` property now directs to `/tax-returns/{id}`, instead of the previous `/tax-returns/{operationNumber}`.\n- For files associated to an `invoice`, the `@iri` property now directs to `/invoices/{id}`, instead of the previous `/invoices/{uuid}`.\n\n### Trying Out This Version\nIf you want to test this version, you can do so by making any request with the `Accept-Version` header pointing to the latest version:\n```curl\n curl -i 'https://api.syntage.com/entities/{entityId}/invoices' \\\n --header 'Accept-Version: 2020-06-28' \\\n --header 'X-Api-Key: {apiKey}'\n```\n"
servers:
- url: https://api.syntage.com
description: Production
- url: https://api.sandbox.syntage.com
description: Sandbox
security:
- ApiKey: []
tags:
- name: Webhook Requests
description: 'Webhook requests are delivery attempts from Syntage to a webhook endpoint. Use them to monitor delivery status, inspect failed deliveries, and connect an event to the endpoint that received it.
'
paths:
/webhook-requests:
get:
tags:
- Webhook Requests
operationId: ListWebhookRequest
description: List webhook delivery attempts for your organization.
summary: List webhook requests
responses:
'200':
$ref: '#/components/responses/WebhookRequestCollection'
'401':
$ref: '#/components/responses/Unauthorized'
parameters:
- name: url
description: Filter by endpoint URL using exact match
in: query
schema:
$ref: '#/components/schemas/WebhookRequestUrl'
- name: responseStatusCode
description: Filter by response status code
in: query
schema:
$ref: '#/components/schemas/WebhookRequestResponseStatusCode'
- name: event.id
description: Filter by event ID
in: query
schema:
$ref: '#/components/schemas/uuid'
- name: event.type
description: Filter by event type
in: query
schema:
$ref: '#/components/schemas/EventType'
- name: event.source
description: Filter by event source
in: query
schema:
$ref: '#/components/schemas/EventSource'
- name: event.resource
description: Filter by event resource
in: query
schema:
$ref: '#/components/schemas/EventResource'
- $ref: '#/components/parameters/collectionCursorNextPageParam'
- $ref: '#/components/parameters/collectionCursorPreviousPageParam'
- $ref: '#/components/parameters/collectionLimit'
/webhook-requests/{id}:
get:
tags:
- Webhook Requests
operationId: GetWebhookRequest
summary: Retrieve webhook request
description: "Get a webhook delivery attempt by ID. Use the response status code, response time, related event, and endpoint details to investigate delivery behavior.\n\n### How to validate webhook calls by using the `signingSecret` value.\nWhenever a webhook is called, a `X-Satws-Signature` header is sent to help verify it. Syntage generates a signature using a hash-based message authentication code (HMAC) with SHA-256 using the `signingSecret` as key. To verify the hash you can do the following steps:\n\n#### Step 1: Extract the timestamp and signature from the header\nSplit the header, using the ` , ` character as the separator. The value for the prefix `t` corresponds to the timestamp and `s` corresponds to the signature.\n\n#### Step 2: Prepare the signed_payload string\nThe signed_payload string is created by concatenating (without spaces):\n\n - The timestamp (as a string in Unix format) example: `\"1656569160\"`\n\n - The character `.` (dot)\n\n - The actual JSON payload (that is, the request body)\n\n#### Step 3: Determine the expected signature\nCompute an HMAC with the SHA256 hash function. Use the endpoint’s signing secret as the key, and use the signed_payload string as the message.\n\n#### Step 4: Compare the signatures\nCompare the signature (or signatures) in the header to the expected signature. For an equality match, compute the difference between the current timestamp and the received timestamp, then decide if the difference is within your tolerance.\nTo protect against timing attacks, use a constant-time string comparison to compare the expected signature to each of the received signatures.\n\n#### Here is a code example using PHP with a constant-time string:\n```php\n function splitString(string $separator, $stringValue): array\n {\n return explode($separator, $stringValue);\n }\n\n ## X-Satws-Signature\n $xSatSignatureHeader = 't=1656569160,s=527124c570b27b3f268777b2ba96a9bbdc4b0ecde2885f688beda528f39c4e23';\n\n list($timestamp, $signature) = array_map(function($signatureParam){\n return splitString('=', $signatureParam)[1];\n }, splitString(',', $xSatSignatureHeader));\n\n $bodyPayload = '{\n \"@context\": \"/contexts/Event\",\n \"@id\": \"/events/88a88df8-5c55-44a4-a222-ef9999c999\",\n \"@type\": \"Event\",\n \"id\": \"88a88df8-5c55-44a4-a222-ef9999c999\",\n \"type\": \"credential.updated\",\n \"source\": None,\n \"createdAt\": \"2022-06-29 20:14:09\",\n \"updatedAt\": \"2022-06-29 20:14:09\"\n }';\n $signingSecret = '320639996d9eee9178bf89d26cdbc23d';\n\n $hash = hash_hmac('sha256', sprintf('%d.%s', $timestamp, $bodyPayload), $signingSecret);\n\n print strcmp($hash, $signature);\n```\n"
parameters:
- $ref: '#/components/parameters/resourceId'
responses:
'200':
$ref: '#/components/responses/WebhookRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
components:
parameters:
collectionCursorNextPageParam:
name: id[lt]
in: query
required: false
example: 91106968-1abd-4d64-85c1-4e73d96fb997
description: Collection cursor pointer to the next page
schema:
type: string
collectionLimit:
name: itemsPerPage
in: query
required: false
description: Number of items per page
schema:
$ref: '#/components/schemas/CollectionLimit'
collectionCursorPreviousPageParam:
name: id[gt]
in: query
required: false
example: 91106968-1abd-4d64-85c1-4e73d96fb997
description: Collection cursor pointer to the previous page
schema:
type: string
resourceId:
name: id
in: path
required: true
example: 91106968-1abd-4d64-85c1-4e73d96fb997
schema:
type: string
format: uuid
responses:
WebhookRequestCollection:
description: Webhook request collection response
content:
application/ld+json:
schema:
$ref: '#/components/schemas/WebhookRequestCollection'
WebhookRequest:
description: Webhook request resource response
content:
application/ld+json:
schema:
allOf:
- type: object
properties:
'@context':
type: string
default: /contexts/WebhookRequest
- $ref: '#/components/schemas/WebhookRequest'
NotFound:
description: Not found
content:
application/json:
schema:
type: object
properties:
message:
type: string
Unauthorized:
description: Unauthorized
content:
application/json:
schema:
type: object
properties:
message:
type: string
schemas:
WebhookEndpointContentType:
type: string
description: Content type used for webhook delivery payloads
enum:
- application/ld+json
- application/json
WebhookEndpointEventType:
type: string
description: Event type delivered to a webhook endpoint
enum:
- credential.created
- credential.updated
- credential.deleted
- link.created
- link.updated
- link.deleted
- extraction.created
- extraction.updated
- invoice.created
- invoice.updated
- invoice.deleted
- tax_return.created
- tax_return.updated
- tax_return.deleted
- file.created
- export.created
- export.updated
- tax_status.created
- tax_status.updated
- tax_status.deleted
- tax_compliance_check.created
- tax_compliance_check.updated
- tax_compliance_check.deleted
- tax_retention.created
- tax_retention.updated
- tax_retention.deleted
- invoice_payment.created
- invoice_payment.updated
- invoice_line_item.created
- invoice_line_item.updated
- electronic_accounting_record.created
- electronic_accounting_record.updated
- rpc_entidades.created
- rpc_entidades.updated
- rpc_socios.created
- rpc_socios.updated
- rpc_acto.created
- rpc_acto.updated
- shareholder_relation.created
- shareholder_relation.updated
- shareholder_relation_source.created
- rug_garantia.created
- rug_garantia.updated
- buro_de_credito_report.created
- buro_de_credito_report.updated
- background_check.created
- sat_certificate.created
- sat_certificate.updated
- company_verification_report.created
- company_verification_report.updated
WebhookRequestUrl:
type: string
format: url
description: Endpoint URL used for the delivery attempt
example: https://example.com/webhooks/syntage
WebhookEndpointEnabled:
type: boolean
example: true
description: Whether Syntage sends matching events to this endpoint
updatedAt:
type: string
description: Date and time the resource was last updated
example: '2020-01-01T12:15:00.000Z'
WebhookRequest:
type: object
properties:
'@id':
type: string
format: iri-reference
description: Webhook request IRI
example: /webhook-requests/91106968-1abd-4d64-85c1-4e73d96fb997
'@type':
type: string
default: WebhookRequest
id:
$ref: '#/components/schemas/uuid'
webhookEndpoint:
description: Webhook endpoint that received the delivery attempt
$ref: '#/components/schemas/WebhookEndpoint'
url:
$ref: '#/components/schemas/WebhookRequestUrl'
responseStatusCode:
$ref: '#/components/schemas/WebhookRequestResponseStatusCode'
responseTime:
type: number
description: Delivery response time in seconds
example: 0.21983
createdAt:
$ref: '#/components/schemas/createdAt'
updatedAt:
$ref: '#/components/schemas/updatedAt'
CollectionLimit:
type: integer
default: 20
minimum: 1
maximum: 1000
createdAt:
type: string
description: Date and time the resource was created
example: '2020-01-01T12:15:00.000Z'
EventResource:
type: string
format: iri-reference
description: Resource related to the event
example: /credentials/91106968-1abd-4d64-85c1-4e73d96fb997
CursorCollection:
type: object
properties:
'@context':
type: string
'@id':
type: string
'@type':
type: string
default: hydra:Collection
hydra:member:
type: array
items:
type: object
hydra:view:
type: object
description: Pagination information
properties:
'@id':
type: string
format: iri-reference
description: Current page IRI reference
'@type':
type: string
default: hydra:PartialCollectionView
hydra:next:
type: string
example: /entity/2a15f539-3251-48e1-aaeb-a154dc9c6edb/resource?id[lt]=9b8e5365-0b36-45f5-9c76-fbe439632367
description: Next page IRI reference; omitted when there is no pagination
hydra:last:
type: string
example: /entity/2a15f539-3251-48e1-aaeb-a154dc9c6edb/resource?id[gt]=9b8e5365-0b36-45f5-9c76-fbe439632367
description: Last page IRI reference; omitted when there is no pagination
hydra:search:
type: object
properties:
'@type':
type: string
hydra:template:
type: string
hydra:variableRepresentation:
type: string
hydra:mapping:
type: array
items:
type: object
properties:
'@type':
type: string
variable:
type: string
property:
type: string
required:
type: boolean
EventSource:
type: string
format: iri-reference
description: Source that originated the event
example: /extractions/91106968-1abd-4d64-85c1-4e73d96fb997
WebhookRequestCollection:
allOf:
- $ref: '#/components/schemas/CursorCollection'
- type: object
properties:
'@context':
default: /contexts/WebhookRequest
'@id':
default: /webhook-requests
hydra:member:
items:
$ref: '#/components/schemas/WebhookRequest'
uuid:
type: string
format: uuid
example: e0a24894-7fbf-48ae-bfb0-efaae30a6319
EventType:
type: string
enum:
- credential.created
- credential.updated
- credential.deleted
- link.created
- link.updated
- link.deleted
- file.created
- extraction.created
- extraction.updated
- invoice.created
- invoice.updated
- invoice.deleted
- invoice_payment.created
- invoice_payment.updated
- invoice_line_item.created
- invoice_line_item.updated
- tax_return.created
- tax_return.updated
- tax_return.deleted
- export.created
- export.updated
- tax_status.created
- tax_status.updated
- tax_status.deleted
- tax_compliance_check.created
- tax_compliance_check.updated
- tax_compliance_check.deleted
- tax_retention.created
- tax_retention.updated
- tax_retention.deleted
- electronic_accounting_record.created
- electronic_accounting_record.updated
- electronic_accounting_record.deleted
- rpc_entidades.created
- rpc_entidades.updated
- rpc_acto.created
- rpc_acto.updated
- rpc_socios.created
- rpc_socios.updated
- shareholder_relation.created
- shareholder_relation.updated
- shareholder_relation_source.created
- rug_garantia.created
- rug_garantia.updated
- buro_de_credito_report.created
- buro_de_credito_report.updated
- sat_certificate.created
- sat_certificate.updated
- background_check.created
- company_verification_report.created
- company_verification_report.updated
example: credential.updated
WebhookEndpointUrl:
type: string
format: url
description: Public HTTPS URL where Syntage sends matching webhook events
example: https://example.com/webhooks/syntage
WebhookRequestResponseStatusCode:
type: integer
description: HTTP status code returned by the endpoint, or `0` when Syntage did not receive a response
example: 200
WebhookEndpoint:
type: object
properties:
'@id':
type: string
format: iri-reference
description: Webhook endpoint IRI
example: /webhook-endpoints/91106968-1abd-4d64-85c1-4e73d96fb997
'@type':
type: string
default: WebhookEndpoint
id:
$ref: '#/components/schemas/uuid'
url:
$ref: '#/components/schemas/WebhookEndpointUrl'
signingSecret:
type: string
description: Secret used to verify `X-Syntage-Signature` delivery headers
example: 54471a278d46c86ec6cd365983552a28
events:
type: array
example:
- extraction.updated
- invoice.created
description: Event types delivered to this endpoint
items:
$ref: '#/components/schemas/WebhookEndpointEventType'
enabled:
default: true
allOf:
- $ref: '#/components/schemas/WebhookEndpointEnabled'
contentType:
default: application/ld+json
anyOf:
- $ref: '#/components/schemas/WebhookEndpointContentType'
createdAt:
$ref: '#/components/schemas/createdAt'
updatedAt:
$ref: '#/components/schemas/updatedAt'
securitySchemes:
ApiKey:
type: apiKey
in: header
name: X-API-Key
description: 'Your API key is available in the [Production](https://app.syntage.com/settings/api-keys) and [Sandbox](https://app.sandbox.syntage.com/settings/api-keys) dashboards.
'
x-readme:
explorer-enabled: true
proxy-enabled: true
samples-enabled: true