Upstox Webhooks

generated: '2026-09-02'
method: searched
source: >-
  https://upstox.com/developer/api-documentation/webhook,
  https://upstox.com/developer/api-documentation/appendix/notifier-webhook-endpoint,
  https://upstox.com/developer/api-documentation/websocket-implementation and
  https://upstox.com/developer/api-documentation/announcements/webhook-url-security-policy
name: Upstox event and streaming surface
description: >-
  Upstox runs a real event surface in three parts — an HTTP webhook (postback) channel for order and GTT
  order updates, two authenticated WebSocket feeds (market data and portfolio), and a notifier webhook
  for access-token requests. It publishes no AsyncAPI document for any of them: the webhook payloads are
  documented as JSON examples on a prose page and the market data feed is Protobuf-framed with the
  schema distributed through the SDKs. Recorded here as a Webhooks catalog, not an AsyncAPI spec —
  nothing is fabricated to fill the AsyncAPI slot.
asyncapi_published: false
asyncapi_probe:
  urls_probed:
  - https://upstox.com/developer/api-documentation/
  - https://api.upstox.com/openapi.json
  - https://api.upstox.com/v3/api-docs
  result: >-
    No asyncapi.yaml, asyncapi.json or event-catalog document is linked from the documentation index,
    the developer llms.txt, or the GitHub organization. The only machine-readable contract Upstox
    publishes is the OpenAPI at https://api.upstox.com/v2/api-docs.
webhooks:
  supported: true
  docs: https://upstox.com/developer/api-documentation/webhook
  configuration: >-
    A postback URL is registered per developer app at https://account.upstox.com/developer/apps. Order
    updates are enabled by default; GTT order updates must be explicitly enabled by editing the app
    configuration on the My Apps page.
  endpoint_requirements:
  - Must not require authentication.
  - Must respond with a 2XX status.
  - Must accept POST requests.
  security:
    signature: false
    signature_note: >-
      Upstox publishes no webhook signature, HMAC or shared-secret verification scheme. The endpoint must
      be unauthenticated and open to POST, and the only guidance given is "provide a webhook URL which is
      in your control rather than a public endpoint". A receiver cannot cryptographically verify that a
      delivery came from Upstox.
    url_validation: true
    url_validation_note: >-
      Since 17 April 2026 Upstox validates every registered webhook URL against a security filter before
      an app can be created, rejecting dynamic DNS, phishing, malware, spam and proxy-bypass hosts. This
      protects Upstox users from a malicious registrant; it does not authenticate deliveries to the
      receiver.
    source: https://upstox.com/developer/api-documentation/announcements/webhook-url-security-policy
  parity_note: The payloads sent to the webhook URL are identical to the updates received over the portfolio WebSocket feed.
  events:
  - name: order
    update_type: order
    description: Order state transition — placement received, open, complete, cancelled, rejected.
    payload_fields:
    - update_type
    - user_id
    - exchange
    - instrument_key
    - trading_symbol
    - product
    - order_type
    - average_price
    - price
    - trigger_price
    - quantity
    - disclosed_quantity
    - pending_quantity
    - transaction_type
    - order_ref_id
    - exchange_order_id
    - parent_order_id
    - validity
    - status
    - is_amo
    - variety
    - tag
    - exchange_timestamp
    - status_message
    - order_id
    - order_request_id
    - order_timestamp
    - filled_quantity
    - guid
    - placed_by
    - status_message_raw
    deprecated_fields:
    - instrument_token
    - tradingsymbol
    - userId
    deprecated_note: The lowercase and camelCase duplicates are deprecated; use the snake_case forms.
    reference: https://upstox.com/developer/api-documentation/appendix/order-status
  - name: gtt_order
    update_type: gtt_order
    description: >-
      Good Till Triggered order rule update. Carries the rules[] array with per-rule strategy
      (ENTRY / STOPLOSS / TARGET), status, trigger_type, trigger_price, transaction_type, message and the
      resulting order_id when a rule fires.
    payload_fields:
    - update_type
    - type
    - exchange
    - instrument_token
    - quantity
    - product
    - gtt_order_id
    - expires_at
    - created_at
    - rules
    enablement: Opt-in — must be enabled on the app configuration from the My Apps page.
  - name: access_token_request
    description: >-
      The notifier webhook endpoint receives automated callbacks for the beta access-token flow, where a
      token initiator requests a token and the user approves it.
    reference: https://upstox.com/developer/api-documentation/appendix/notifier-webhook-endpoint
    docs: https://upstox.com/developer/api-documentation/access-token-request
websocket_feeds:
- name: Market Data Feed
  version: v3
  authorize_operation: getMarketDataFeedAuthorize
  feed_operation: getMarketDataFeed
  path: /v2/feed/market-data-feed
  v3_path: /v3/feed/market-data-feed
  encoding: Protobuf
  flow: Call the authorize endpoint over REST to obtain a signed WebSocket URL, then connect.
  modes: LTPC, full, D30 (full market depth, Upstox Plus)
  limits: Up to 5 concurrent connections per user and 50 instruments per connection on D30, under Upstox Plus.
  docs: https://upstox.com/developer/api-documentation/websocket-implementation
  deprecation: V2 feed discontinued 22 August 2025; V3 only.
- name: Portfolio Stream Feed
  authorize_operation: getPortfolioStreamFeedAuthorize
  feed_operation: getPortfolioStreamFeed
  path: /v2/feed/portfolio-stream-feed
  encoding: JSON
  flow: Call the authorize endpoint over REST to obtain a signed WebSocket URL, then connect.
  emits: Order updates, position updates, GTT order updates — selectable via the update_types parameter.
  parity: Same payloads as the webhook channel.
  docs: https://upstox.com/developer/api-documentation/get-portfolio-stream-feed
sample_implementations:
  languages:
  - Python
  - PHP
  - Node.js
  - Java
  - React
  url: https://upstox.com/developer/api-documentation/sample-implementation
gaps:
- No AsyncAPI document for either WebSocket feed or the webhook channel.
- No webhook signature or replay-protection scheme.
- No published retry or delivery-guarantee policy for webhook deliveries.
- The Protobuf schema for the market data feed is distributed inside the SDKs rather than published as a standalone .proto in the documentation or the GitHub organization.