Webhooks ​

The Agio Platform uses an event-driven architecture. Webhooks fall into three categories: external service callbacks (from third-party providers), database event triggers (fired by Hasura when rows change), and cron triggers (scheduled jobs).

Authentication ​

External Service Webhooks ​

These endpoints receive callbacks from third-party services. Each service signs its payloads using a service-specific scheme.

POST /webhooks/on-insert-bitgo-webhook-payload-transaction ​

Receives transaction notifications from BitGo. Payloads are signed using BitGo's webhook signature scheme.

• Auth: BitGo HMAC signature
• Triggers: Wallet balance updates, transaction confirmations, pending approval notifications

Example payload:

{
  "hash": "0xabc123...",
  "transfer": "txid_abc123",
  "coin": "eth",
  "type": "transfer",
  "state": "confirmed",
  "walletId": "wallet_abc123"
}

POST /webhooks/on-card-webhook ​

Receives card and payment events from Agio Cards.

• Auth: Agio Card payload signature
• Triggers: Card status changes, transaction authorizations, settlements, card spend events

Example payload:

{
  "eventType": "TRANSACTION_AUTHORIZED",
  "cardId": "card_abc123",
  "amount": 150.0,
  "currency": "USD",
  "merchantName": "Example Merchant",
  "timestamp": "2026-03-23T10:30:00Z"
}

POST /webhooks/on-sumsub-webhook-payload ​

Receives KYC/AML verification events from Sumsub.

• Auth: HMAC-SHA1 signature in x-payload-digest header
• Triggers: Applicant review status changes, document verification results

See the KYC Webhook Data page for full field reference and status codes.

Example payload:

{
  "applicantId": "5cb744200a975a67ed1798a4",
  "inspectionId": "5cb744200a975a67ed1798a5",
  "externalUserId": "auth0|abc123",
  "type": "applicantReviewed",
  "reviewStatus": "completed",
  "reviewResult": {
    "reviewAnswer": "GREEN"
  },
  "createdAt": "2026-03-23T10:30:00+0000"
}

POST /webhooks/on-auth0-log-streams ​

Receives authentication log events from Auth0 Log Streams.

• Auth: IP allowlist (Auth0 egress IPs only)
• Triggers: Login events, failed authentication attempts, password changes, MFA events

Example payload:

{
  "log_id": "90020260323...",
  "data": {
    "type": "s",
    "connection": "Username-Password-Authentication",
    "user_id": "auth0|abc123",
    "ip": "203.0.113.42"
  }
}

Database Event Webhooks ​

These endpoints are called by Hasura event triggers when database rows are inserted, updated, or deleted. All require the x-agio-api-token header.

User Lifecycle ​

KYC ​

Trading ​

Wallets ​

Transactions ​

Invoicing ​

Cards ​

Fiat Operations ​

Cron Triggers ​

Scheduled jobs executed at fixed intervals via Hasura cron triggers. All require the x-agio-api-token header.