A test delivery sent from the dashboard

webhook

webhook.test

Sent when someone presses Send test on an endpoint in the merchant dashboard: one signed
delivery, right away, through the same transport and with the same headers and signature as a real
event. It is never retried or queued and carries no order or wallet data — the dashboard shows the
HTTP outcome. Verify it like any delivery, acknowledge it with 2xx, and otherwise ignore it.

Payload

The dashboard's test delivery — signed like any event, sent once, carrying no order or wallet data.

uuid

required

type

const

enum

required

Allowed:

occurredAtUtc

date-time

required

data

object

required

Headers

X-Xegora-Event-Id

string

required

^[0-9a-f]{32}$

The event's stable unique id — your deduplication key, identical on every retry. It is the envelope's id without dashes (32 lowercase hex characters), and it is the exact string signed inside X-Xegora-Signature.

X-Xegora-Timestamp

string

required

^[0-9]+$

Unix seconds at signing time — your freshness check. Reject deliveries more than 5 minutes from your clock.

X-Xegora-Signature

string

required

^v1=[0-9a-f]{64}$

v1= followed by 64 lowercase hex characters: HMAC-SHA256 over the UTF-8 string {X-Xegora-Timestamp}.{X-Xegora-Event-Id}.{raw body}, keyed with your endpoint's xgwh_… signing secret. Verify over the raw request bytes with a constant-time comparison.

X-Xegora-Delivery-Contract

const

enum

required

The delivery-contract version — currently always xegora-webhook-at-least-once-v1.

Allowed:

Response

200

Acknowledged — the dashboard reports the status code it received.