API reference · Platform & integration

Webhooks

GET/webhook/deliveryList deliveries
GET/webhook/delivery/{reference}Read one delivery, with every attempt
POST/webhook/delivery/{reference}/replayReplay a delivery
GET/webhook/endpointList webhook endpoints
POST/webhook/endpointRegister a webhook endpoint
DELETE/webhook/endpoint/{reference}Delete a webhook endpoint
GET/webhook/endpoint/{reference}Read one webhook endpoint
PUT/webhook/endpoint/{reference}Update a webhook endpoint
POST/webhook/endpoint/{reference}/pausePause a webhook endpoint
POST/webhook/endpoint/{reference}/resumeResume a webhook endpoint
GET/webhook/endpoint/{reference}/secretList an endpoint's signing secrets
POST/webhook/endpoint/{reference}/secretRotate an endpoint's signing secret
DELETE/webhook/endpoint/{reference}/secret/{secretReference}Retire a signing secret immediately
GET/webhook/endpoint/{reference}/subscriptionList an endpoint's subscriptions
POST/webhook/endpoint/{reference}/subscriptionAdd one subscription
PUT/webhook/endpoint/{reference}/subscriptionReplace an endpoint's subscriptions
DELETE/webhook/endpoint/{reference}/subscription/{eventType}Remove one subscription
POST/webhook/endpoint/{reference}/testSend a test event
GET/webhook/event-typeList the webhook event types
GET/webhook/event-type/{eventType}Read one webhook event type
GET/webhook/event/{reference}Read one recorded event
POST/webhook/event/{reference}/replayReplay an event to every endpoint of yours that received it

GET List deliveries

GET /webhook/delivery

Every delivery Bridge attempted to endpoints you own, newest first. Attempts are on the detail view rather than here, so this stays cheap.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Query parameters

Name	Default
`endpointReference`	Optional
`status`	Optional
`limit`	50
`organizationReference`	Optional

Example

Response: GenericResponseListWebhookDeliveryResponse

curl -X GET "https://api.bridgemoni.com/webhook/delivery?limit=50" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": [
    {
      "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "eventReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "target": "ENDPOINT",
      "targetUrl": "string",
      "eventType": {
        "name": "string"
      },
      "status": "PENDING",
      "attemptCount": 0,
      "nextAttemptAt": "2026-09-25T10:00:00Z",
      "lastResponseStatus": 0,
      "lastFailureKind": "HTTP_ERROR",
      "lastError": "string",
      "completedAt": "2026-09-25T10:00:00Z",
      "replayOf": "string",
      "createdAt": "2026-09-25T10:00:00Z",
      "attempts": [
        {
          "attemptNumber": 0,
          "attemptedAt": "2026-09-25T10:00:00Z",
          "durationMs": 0,
          "responseStatus": 0,
          "responseSnippet": "string",
          "failureKind": "HTTP_ERROR",
          "errorMessage": "string",
          "signedWithVersions": "1,2",
          "requestBodyBytes": 0
        }
      ]
    }
  ],
  "description": "Webhook deliveries retrieved"
}

Responses

Status	When
`200`	Webhook deliveries retrieved
`403`	You cannot act for that organization
`404`	Webhook endpoint not found

GET Read one delivery, with every attempt

GET /webhook/delivery/{reference}

Each attempt carries your server's own status code, how long it took, and up to 2KB of the response body it returned. That is usually the whole diagnosis.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookDeliveryResponse

curl -X GET "https://api.bridgemoni.com/webhook/delivery/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "eventReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "target": "ENDPOINT",
    "targetUrl": "string",
    "eventType": {
      "name": "string"
    },
    "status": "PENDING",
    "attemptCount": 0,
    "nextAttemptAt": "2026-09-25T10:00:00Z",
    "lastResponseStatus": 0,
    "lastFailureKind": "HTTP_ERROR",
    "lastError": "string",
    "completedAt": "2026-09-25T10:00:00Z",
    "replayOf": "string",
    "createdAt": "2026-09-25T10:00:00Z",
    "attempts": [
      {
        "attemptNumber": 0,
        "attemptedAt": "2026-09-25T10:00:00Z",
        "durationMs": 0,
        "responseStatus": 0,
        "responseSnippet": "string",
        "failureKind": "HTTP_ERROR",
        "errorMessage": "string",
        "signedWithVersions": "1,2",
        "requestBodyBytes": 0
      }
    ]
  },
  "description": "Webhook delivery retrieved"
}

Responses

Status	When
`200`	Webhook delivery retrieved
`403`	You cannot act for that organization
`404`	Webhook delivery not found

POST Replay a delivery

POST /webhook/delivery/{reference}/replay

Creates a NEW delivery and never modifies the original - the record of what was attempted and when is not editable. Permitted on a delivery that already succeeded, which is a common recovery move when your own consumer crashed after acknowledging. Replays are signed with your CURRENT secrets, not the ones in force originally.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookReplayResponse

curl -X POST "https://api.bridgemoni.com/webhook/delivery/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/replay" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "deliveries": [
      {
        "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "eventReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "target": "ENDPOINT",
        "targetUrl": "string",
        "eventType": {
          "name": "string"
        },
        "status": "PENDING",
        "attemptCount": 0,
        "nextAttemptAt": "2026-09-25T10:00:00Z",
        "lastResponseStatus": 0,
        "lastFailureKind": "HTTP_ERROR",
        "lastError": "string",
        "completedAt": "2026-09-25T10:00:00Z",
        "replayOf": "string",
        "createdAt": "2026-09-25T10:00:00Z",
        "attempts": [
          {
            "attemptNumber": 0,
            "attemptedAt": "2026-09-25T10:00:00Z",
            "durationMs": 0,
            "responseStatus": 0,
            "responseSnippet": "string",
            "failureKind": "HTTP_ERROR",
            "errorMessage": "string",
            "signedWithVersions": "1,2",
            "requestBodyBytes": 0
          }
        ]
      }
    ]
  },
  "description": "Webhook delivery replayed"
}

Responses

Status	When
`200`	Webhook delivery replayed
`403`	You cannot act for that organization
`404`	Webhook delivery not found
`409`	That endpoint has been deleted or disabled and cannot receive a replay

GET List webhook endpoints

GET /webhook/endpoint

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Query parameters

Name	Default
`status`	Optional
`organizationReference`	Optional

Example

Response: GenericResponseListWebhookEndpointResponse

curl -X GET "https://api.bridgemoni.com/webhook/endpoint" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": [
    {
      "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "url": "string",
      "transport": "HTTP",
      "label": {
        "name": "string"
      },
      "description": "string",
      "ownerType": "USER",
      "ownerReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "status": "ACTIVE",
      "statusReason": "string",
      "statusChangedAt": "2026-09-25T10:00:00Z",
      "deliveryMode": "UNORDERED",
      "apiVersion": {
        "name": "string"
      },
      "subscriptions": [
        {
          "eventType": {
            "name": "string"
          },
          "pattern": true,
          "currentlyMatches": [
            {
              "name": "string"
            }
          ]
        }
      ],
      "headers": [
        {
          "name": {
            "name": "string"
          },
          "maskedValue": "led\u2026ync"
        }
      ],
      "consecutiveFailures": 0,
      "lastSuccessAt": "2026-09-25T10:00:00Z",
      "lastFailureAt": "2026-09-25T10:00:00Z",
      "createdAt": "2026-09-25T10:00:00Z"
    }
  ],
  "description": "Webhook endpoints retrieved"
}

Responses

Status	When
`200`	Webhook endpoints retrieved
`403`	You cannot act for that organization

POST Register a webhook endpoint

POST /webhook/endpoint

Registers a destination and issues its first signing secret. **The secret is returned in this response and nowhere else, ever** - store it before you close the response. Every delivery to this endpoint is signed with it, and verifying that signature is the only thing that distinguishes a Bridge event from an unauthenticated POST from the internet.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Query parameters

Name	Default
`organizationReference`	Optional

Example

Request body: CreateWebhookEndpointRequest · Response: GenericResponseCreateWebhookEndpointResponse

curl -X POST "https://api.bridgemoni.com/webhook/endpoint" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://api.merchant.example.com/bridge/events",
  "transport": "HTTP",
  "label": "Production ledger sync",
  "description": "string",
  "deliveryMode": "UNORDERED",
  "eventTypes": [
    {
      "name": "string"
    }
  ],
  "headers": [
    {
      "name": "X-Merchant-Route",
      "value": "string"
    }
  ]
}'

{
  "url": "https://api.merchant.example.com/bridge/events",
  "transport": "HTTP",
  "label": "Production ledger sync",
  "description": "string",
  "deliveryMode": "UNORDERED",
  "eventTypes": [
    {
      "name": "string"
    }
  ],
  "headers": [
    {
      "name": "X-Merchant-Route",
      "value": "string"
    }
  ]
}

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "url": "string",
    "transport": "HTTP",
    "label": {
      "name": "string"
    },
    "description": "string",
    "ownerType": "USER",
    "ownerReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "status": "ACTIVE",
    "deliveryMode": "UNORDERED",
    "apiVersion": {
      "name": "string"
    },
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ],
    "headers": [
      {
        "name": {
          "name": "string"
        },
        "maskedValue": "led\u2026ync"
      }
    ],
    "secret": {
      "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "version": 0,
      "prefix": "string",
      "status": "ACTIVE",
      "value": "whsec_7f3a91c25d84e6b0a7c1f4e83b96d5021c7a4e9f6b2d8c3015a7e94f2b6d8c31",
      "createdAt": "2026-09-25T10:00:00Z",
      "retiring": {
        "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "version": 2,
        "prefix": "whsec_7f",
        "status": "ACTIVE",
        "retiresAt": "2026-09-25T10:00:00Z",
        "revokedAt": "2026-09-25T10:00:00Z",
        "lastUsedAt": "2026-09-25T10:00:00Z",
        "createdAt": "2026-09-25T10:00:00Z"
      }
    },
    "createdAt": "2026-09-25T10:00:00Z"
  },
  "description": "Webhook endpoint registered"
}

Responses

Status	When
`200`	Webhook endpoint registered
`400`	URL malformed or not reachable from Bridge; header name reserved; unknown event type; unsupported transport
`403`	You cannot act for that organization
`409`	You already have an endpoint at that URL; endpoint limit reached

DELETE Delete a webhook endpoint

DELETE /webhook/endpoint/{reference}

Stops delivery permanently. The endpoint's history is retained so that what it was sent stays answerable, and its URL stays reserved to you.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseVoid

curl -X DELETE "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": "string",
  "description": "Webhook endpoint deleted"
}

Responses

Status	When
`200`	Webhook endpoint deleted
`403`	You cannot act for that organization
`404`	Webhook endpoint not found

GET Read one webhook endpoint

GET /webhook/endpoint/{reference}

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookEndpointResponse

curl -X GET "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "url": "string",
    "transport": "HTTP",
    "label": {
      "name": "string"
    },
    "description": "string",
    "ownerType": "USER",
    "ownerReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "status": "ACTIVE",
    "statusReason": "string",
    "statusChangedAt": "2026-09-25T10:00:00Z",
    "deliveryMode": "UNORDERED",
    "apiVersion": {
      "name": "string"
    },
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ],
    "headers": [
      {
        "name": {
          "name": "string"
        },
        "maskedValue": "led\u2026ync"
      }
    ],
    "consecutiveFailures": 0,
    "lastSuccessAt": "2026-09-25T10:00:00Z",
    "lastFailureAt": "2026-09-25T10:00:00Z",
    "createdAt": "2026-09-25T10:00:00Z"
  },
  "description": "Webhook endpoint retrieved"
}

Responses

Status	When
`200`	Webhook endpoint retrieved
`403`	You cannot act for that organization
`404`	Webhook endpoint not found

PUT Update a webhook endpoint

PUT /webhook/endpoint/{reference}

A partial update: omitted fields are left alone, and a supplied header list replaces the whole set. **Changing the URL does not rotate the secret** - the two are separate decisions, and coupling them would mean a routine path change silently breaks your signature verification. It does re-check the destination and reset the failure counter.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Request body: UpdateWebhookEndpointRequest · Response: GenericResponseWebhookEndpointResponse

curl -X PUT "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "string",
  "label": {
    "name": "string"
  },
  "description": "string",
  "deliveryMode": "UNORDERED",
  "headers": [
    {
      "name": "X-Merchant-Route",
      "value": "string"
    }
  ]
}'

{
  "url": "string",
  "label": {
    "name": "string"
  },
  "description": "string",
  "deliveryMode": "UNORDERED",
  "headers": [
    {
      "name": "X-Merchant-Route",
      "value": "string"
    }
  ]
}

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "url": "string",
    "transport": "HTTP",
    "label": {
      "name": "string"
    },
    "description": "string",
    "ownerType": "USER",
    "ownerReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "status": "ACTIVE",
    "statusReason": "string",
    "statusChangedAt": "2026-09-25T10:00:00Z",
    "deliveryMode": "UNORDERED",
    "apiVersion": {
      "name": "string"
    },
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ],
    "headers": [
      {
        "name": {
          "name": "string"
        },
        "maskedValue": "led\u2026ync"
      }
    ],
    "consecutiveFailures": 0,
    "lastSuccessAt": "2026-09-25T10:00:00Z",
    "lastFailureAt": "2026-09-25T10:00:00Z",
    "createdAt": "2026-09-25T10:00:00Z"
  },
  "description": "Webhook endpoint updated"
}

Responses

Status	When
`200`	Webhook endpoint updated
`400`	URL malformed or not reachable from Bridge
`403`	You cannot act for that organization
`404`	Webhook endpoint not found
`409`	You already have an endpoint at that URL; this endpoint has been deleted

POST Pause a webhook endpoint

POST /webhook/endpoint/{reference}/pause

Stops delivery without losing anything: events still fan out and the backlog accrues, so resuming replays what was missed rather than starting from empty. Use this during a deploy.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`reason`	Optional
`organizationReference`	Optional

Example

Response: GenericResponseWebhookEndpointResponse

curl -X POST "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/pause" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "url": "string",
    "transport": "HTTP",
    "label": {
      "name": "string"
    },
    "description": "string",
    "ownerType": "USER",
    "ownerReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "status": "ACTIVE",
    "statusReason": "string",
    "statusChangedAt": "2026-09-25T10:00:00Z",
    "deliveryMode": "UNORDERED",
    "apiVersion": {
      "name": "string"
    },
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ],
    "headers": [
      {
        "name": {
          "name": "string"
        },
        "maskedValue": "led\u2026ync"
      }
    ],
    "consecutiveFailures": 0,
    "lastSuccessAt": "2026-09-25T10:00:00Z",
    "lastFailureAt": "2026-09-25T10:00:00Z",
    "createdAt": "2026-09-25T10:00:00Z"
  },
  "description": "Webhook endpoint paused"
}

Responses

Status	When
`200`	Webhook endpoint paused
`403`	You cannot act for that organization
`404`	Webhook endpoint not found
`409`	This endpoint cannot be paused

POST Resume a webhook endpoint

POST /webhook/endpoint/{reference}/resume

Restarts delivery and replays the backlog, resetting the failure counter. An endpoint disabled by an operator cannot be resumed this way.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookEndpointResponse

curl -X POST "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/resume" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "url": "string",
    "transport": "HTTP",
    "label": {
      "name": "string"
    },
    "description": "string",
    "ownerType": "USER",
    "ownerReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "status": "ACTIVE",
    "statusReason": "string",
    "statusChangedAt": "2026-09-25T10:00:00Z",
    "deliveryMode": "UNORDERED",
    "apiVersion": {
      "name": "string"
    },
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ],
    "headers": [
      {
        "name": {
          "name": "string"
        },
        "maskedValue": "led\u2026ync"
      }
    ],
    "consecutiveFailures": 0,
    "lastSuccessAt": "2026-09-25T10:00:00Z",
    "lastFailureAt": "2026-09-25T10:00:00Z",
    "createdAt": "2026-09-25T10:00:00Z"
  },
  "description": "Webhook endpoint resumed"
}

Responses

Status	When
`200`	Webhook endpoint resumed
`403`	You cannot act for that organization
`404`	Webhook endpoint not found
`409`	This endpoint cannot be resumed

GET List an endpoint's signing secrets

GET /webhook/endpoint/{reference}/secret

Metadata only - version, prefix, status and dates. The values are not retrievable.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseListWebhookSecretResponse

curl -X GET "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/secret" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": [
    {
      "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "version": 2,
      "prefix": "whsec_7f",
      "status": "ACTIVE",
      "retiresAt": "2026-09-25T10:00:00Z",
      "revokedAt": "2026-09-25T10:00:00Z",
      "lastUsedAt": "2026-09-25T10:00:00Z",
      "createdAt": "2026-09-25T10:00:00Z"
    }
  ],
  "description": "Webhook signing secrets retrieved"
}

Responses

Status	When
`200`	Webhook signing secrets retrieved
`403`	You cannot act for that organization
`404`	Webhook endpoint not found

POST Rotate an endpoint's signing secret

POST /webhook/endpoint/{reference}/secret

Issues a new secret and puts the existing one into a retirement window. **During the window every delivery carries a signature under each secret**, so you can deploy the new one at your own pace and roll back without dropping an event - your verification code should accept a match against any v1= value in the header. The new secret is returned here and nowhere else, ever.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Request body: RotateWebhookSecretRequest · Response: GenericResponseWebhookSecretRevealResponse

curl -X POST "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/secret" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "retireExistingAfterHours": 24
}'

{
  "retireExistingAfterHours": 24
}

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "version": 0,
    "prefix": "string",
    "status": "ACTIVE",
    "value": "whsec_7f3a91c25d84e6b0a7c1f4e83b96d5021c7a4e9f6b2d8c3015a7e94f2b6d8c31",
    "createdAt": "2026-09-25T10:00:00Z",
    "retiring": {
      "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "version": 2,
      "prefix": "whsec_7f",
      "status": "ACTIVE",
      "retiresAt": "2026-09-25T10:00:00Z",
      "revokedAt": "2026-09-25T10:00:00Z",
      "lastUsedAt": "2026-09-25T10:00:00Z",
      "createdAt": "2026-09-25T10:00:00Z"
    }
  },
  "description": "Webhook signing secret rotated"
}

Responses

Status	When
`200`	Webhook signing secret rotated
`403`	You cannot act for that organization
`404`	Webhook endpoint not found
`409`	A rotation is already in progress; this endpoint has been deleted

DELETE Retire a signing secret immediately

DELETE /webhook/endpoint/{reference}/secret/{secretReference}

Ends the overlap early - for a secret you believe has leaked. Refused if it is the last one that can sign, because an endpoint that cannot sign cannot deliver.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`
`secretReference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseVoid

curl -X DELETE "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/secret/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": "string",
  "description": "Webhook signing secret revoked"
}

Responses

Status	When
`200`	Webhook signing secret revoked
`403`	You cannot act for that organization
`404`	Webhook endpoint or signing secret not found
`409`	That is the endpoint's last signing secret

GET List an endpoint's subscriptions

GET /webhook/endpoint/{reference}/subscription

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookSubscriptionSetResponse

curl -X GET "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/subscription" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ]
  },
  "description": "Webhook subscriptions retrieved"
}

Responses

Status	When
`200`	Webhook subscriptions retrieved
`403`	You cannot act for that organization
`404`	Webhook endpoint not found

POST Add one subscription

POST /webhook/endpoint/{reference}/subscription

Leaves the rest alone. Deliberately not idempotent - a duplicate usually means two places in your configuration disagree about what this endpoint is for.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Request body: AddWebhookSubscriptionRequest · Response: GenericResponseWebhookSubscriptionSetResponse

curl -X POST "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/subscription" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "eventType": {
    "name": "string"
  }
}'

{
  "eventType": {
    "name": "string"
  }
}

{
  "data": {
    "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ]
  },
  "description": "Webhook subscription added"
}

Responses

Status	When
`200`	Webhook subscription added
`400`	Unknown event type; a pattern that matches nothing; event type retired
`403`	You cannot act for that organization; that event type needs a permission you do not hold
`404`	Webhook endpoint not found
`409`	Already subscribed; subscription limit reached

PUT Replace an endpoint's subscriptions

PUT /webhook/endpoint/{reference}/subscription

A genuine replace, which is the shape your infrastructure-as-code wants: types present become active, types absent are removed, and running it twice changes nothing the second time. Accepts exact names, resource.* patterns and *; the response expands each pattern to what it matches today, so you can see what you just subscribed to without reading a changelog.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Request body: WebhookSubscriptionRequest · Response: GenericResponseWebhookSubscriptionSetResponse

curl -X PUT "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/subscription" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "eventTypes": [
    {
      "name": "string"
    }
  ]
}'

{
  "eventTypes": [
    {
      "name": "string"
    }
  ]
}

{
  "data": {
    "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ]
  },
  "description": "Webhook subscriptions replaced"
}

Responses

Status	When
`200`	Webhook subscriptions replaced
`400`	Unknown event type; a pattern that matches nothing; event type retired
`403`	You cannot act for that organization; that event type needs a permission you do not hold
`404`	Webhook endpoint not found
`409`	Subscription limit reached

DELETE Remove one subscription

DELETE /webhook/endpoint/{reference}/subscription/{eventType}

Removes exactly the entry named. Removing an event type does not remove a pattern that happens to match it, and vice versa - they are separate entries.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`
`eventType`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookSubscriptionSetResponse

curl -X DELETE "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/subscription/value" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "subscriptions": [
      {
        "eventType": {
          "name": "string"
        },
        "pattern": true,
        "currentlyMatches": [
          {
            "name": "string"
          }
        ]
      }
    ]
  },
  "description": "Webhook subscription removed"
}

Responses

Status	When
`200`	Webhook subscription removed
`403`	You cannot act for that organization
`404`	Webhook endpoint not found; not subscribed to that event type

POST Send a test event

POST /webhook/endpoint/{reference}/test

A real delivery through the real pipeline with a real signature, so whatever your receiver does with it is exactly what it will do with a transfer.completed. Poll GET /webhook/delivery/{reference} for the result - including your own response body if it failed.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookDeliveryResponse

curl -X POST "https://api.bridgemoni.com/webhook/endpoint/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/test" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "eventReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "target": "ENDPOINT",
    "targetUrl": "string",
    "eventType": {
      "name": "string"
    },
    "status": "PENDING",
    "attemptCount": 0,
    "nextAttemptAt": "2026-09-25T10:00:00Z",
    "lastResponseStatus": 0,
    "lastFailureKind": "HTTP_ERROR",
    "lastError": "string",
    "completedAt": "2026-09-25T10:00:00Z",
    "replayOf": "string",
    "createdAt": "2026-09-25T10:00:00Z",
    "attempts": [
      {
        "attemptNumber": 0,
        "attemptedAt": "2026-09-25T10:00:00Z",
        "durationMs": 0,
        "responseStatus": 0,
        "responseSnippet": "string",
        "failureKind": "HTTP_ERROR",
        "errorMessage": "string",
        "signedWithVersions": "1,2",
        "requestBodyBytes": 0
      }
    ]
  },
  "description": "Test delivery queued"
}

Responses

Status	When
`200`	Test delivery queued
`403`	You cannot act for that organization
`404`	Webhook endpoint not found
`409`	That endpoint cannot receive a test

GET List the webhook event types

GET /webhook/event-type

Every event type this tenant can deliver, with what it means and what subscribing to it costs. Event type names never change once published: a superseded type is marked DEPRECATED with a retirement date and keeps firing until it passes.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Query parameters

Name	Default
`resource`	Optional
`status`	Optional

Example

Response: GenericResponseListWebhookEventTypeResponse

curl -X GET "https://api.bridgemoni.com/webhook/event-type" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": [
    {
      "eventType": "transfer.completed",
      "resource": "transfer",
      "module": "transactions",
      "description": "string",
      "apiVersion": 1.0,
      "status": "ACTIVE",
      "highVolume": true,
      "restricted": true,
      "volumeWarning": "string",
      "retiresAt": "2026-09-25T10:00:00Z",
      "samplePayload": "string"
    }
  ],
  "description": "Webhook event types retrieved"
}

Responses

Status	When
`200`	Webhook event types retrieved

GET Read one webhook event type

GET /webhook/event-type/{eventType}

The catalogue entry for a single event type, by its exact published name.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`eventType`

Example

Response: GenericResponseWebhookEventTypeResponse

curl -X GET "https://api.bridgemoni.com/webhook/event-type/value" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "eventType": "transfer.completed",
    "resource": "transfer",
    "module": "transactions",
    "description": "string",
    "apiVersion": 1.0,
    "status": "ACTIVE",
    "highVolume": true,
    "restricted": true,
    "volumeWarning": "string",
    "retiresAt": "2026-09-25T10:00:00Z",
    "samplePayload": "string"
  },
  "description": "Webhook event type retrieved"
}

Responses

Status	When
`200`	Webhook event type retrieved
`404`	Webhook event type not found

GET Read one recorded event

GET /webhook/event/{reference}

Including the exact payload that was delivered. Rendered once when the event was recorded, so this is what happened rather than a re-derivation - re-deriving a transfer that has since been reversed would show you a lie.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookEventResponse

curl -X GET "https://api.bridgemoni.com/webhook/event/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "eventType": {
      "name": "string"
    },
    "apiVersion": {
      "name": "string"
    },
    "occurredAt": "2026-09-25T10:00:00Z",
    "subjectType": {
      "name": "string"
    },
    "subjectReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "status": "PENDING",
    "deliveryCount": 0,
    "payload": "string",
    "createdAt": "2026-09-25T10:00:00Z"
  },
  "description": "Webhook event retrieved"
}

Responses

Status	When
`200`	Webhook event retrieved
`403`	You cannot act for that organization
`404`	Webhook event not found

POST Replay an event to every endpoint of yours that received it

POST /webhook/event/{reference}/replay

The right shape when the fix was on our side rather than yours. Endpoints belonging to other parties to the same event are never re-delivered on your say-so.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`reference`

Query parameters

Name	Default
`organizationReference`	Optional

Example

Response: GenericResponseWebhookReplayResponse

curl -X POST "https://api.bridgemoni.com/webhook/event/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/replay" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": {
    "deliveries": [
      {
        "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "eventReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "endpointReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
        "target": "ENDPOINT",
        "targetUrl": "string",
        "eventType": {
          "name": "string"
        },
        "status": "PENDING",
        "attemptCount": 0,
        "nextAttemptAt": "2026-09-25T10:00:00Z",
        "lastResponseStatus": 0,
        "lastFailureKind": "HTTP_ERROR",
        "lastError": "string",
        "completedAt": "2026-09-25T10:00:00Z",
        "replayOf": "string",
        "createdAt": "2026-09-25T10:00:00Z",
        "attempts": [
          {
            "attemptNumber": 0,
            "attemptedAt": "2026-09-25T10:00:00Z",
            "durationMs": 0,
            "responseStatus": 0,
            "responseSnippet": "string",
            "failureKind": "HTTP_ERROR",
            "errorMessage": "string",
            "signedWithVersions": "1,2",
            "requestBodyBytes": 0
          }
        ]
      }
    ]
  },
  "description": "Webhook event replayed"
}

Responses

Status	When
`200`	Webhook event replayed
`403`	You cannot act for that organization
`404`	Webhook event not found

Generated from the OpenAPI document. Branch on the HTTP status: there is no machine-readable error code on the wire. Errors