Webhooks

Webhooks today are inbound, not outbound.

Inbound: your payment gateway #

AVRA receives webhooks from your payment gateway, at a URL unique to your brand and your gateway — /api/public/payouts/{provider}/webhook/{brand_id} — so that a reward payout's final state comes from the gateway rather than from polling. Every payload is signature-verified, and an unsigned or wrongly signed one is rejected. We have written the tests that prove an empty credential cannot verify anything, because at one point it could.

When online payment is switched on (today credits are invoiced), that payment is confirmed on AVRA's own gateway account, not yours: /api/public/topups/{provider}/webhook only prompts AVRA to ask the gateway, and the gateway's answer is the record.

Outbound: not yet #

Outbound webhooks — AVRA calling your system when a code is scanned, a warranty is registered or a claim is held — do not exist yet. If you need one now, the honest interim is a polled read of the dashboard endpoints (/api/dashboard/recent-scans, /alerts), or a file we produce for you on request; say so and we will help you set it up.

Last reviewed 19 Oct 2026 · Something wrong? connect@avrascan.com