Webhooks

Per-org endpoint + secret; HMAC delivery; list and retry via API.

Endpoint

• GET /api/v1/webhook-endpoints
• PUT /api/v1/webhook-endpoints — set url; rotateSecret: true returns plaintext once (whsec_…)

Deliveries

• GET /api/v1/webhook-deliveries
• POST /api/v1/webhook-deliveries/:id/retry

Events

checkout.funded, checkout.accepted, checkout.released, checkout.disputed, checkout.refunded, checkout.cancelled. checkout.paid aliases released.

Verify signatures

Header X-Bruce-Signature: sha256=<hmac> over the raw body using your endpoint secret (or legacy platform secret during migration). Also X-Bruce-Delivery-Id, X-Bruce-Event.

MCP: bruce_webhook_endpoint_get, bruce_webhook_deliveries_list.