Skip to main content
WEBHOOK
incoming-payment
{
  "transaction": {
    "id": "Transaction:019542f5-b3e7-1d02-0000-000000000005",
    "status": "PENDING",
    "type": "INCOMING",
    "senderUmaAddress": "$sender@external.domain",
    "receiverUmaAddress": "$recipient@uma.domain",
    "receivedAmount": {
      "amount": 50000,
      "currency": {
        "code": "USD",
        "name": "United States Dollar",
        "symbol": "$",
        "decimals": 2
      }
    },
    "customerId": "Customer:019542f5-b3e7-1d02-0000-000000000001",
    "platformCustomerId": "18d3e5f7b4a9c2",
    "reconciliationInstructions": {
      "reference": "REF-123456789"
    },
    "counterpartyInformation": {
      "FULL_NAME": "John Sender",
      "BIRTH_DATE": "1985-06-15",
      "NATIONALITY": "US"
    }
  },
  "requestedReceiverCustomerInfoFields": [
    {
      "name": "NATIONALITY",
      "mandatory": true
    },
    {
      "name": "ADDRESS",
      "mandatory": false
    }
  ],
  "timestamp": "2025-08-15T14:32:00Z",
  "webhookId": "Webhook:019542f5-b3e7-1d02-0000-000000000007",
  "type": "INCOMING_PAYMENT"
}
{
  "receiverCustomerInfo": {}
}

Authorizations

​
X-Grid-Signature
string
header
required

Secp256r1 (P-256) asymmetric signature of the webhook payload, which can be used to verify that the webhook was sent by Grid.

To verify the signature:

  1. Get the Grid public key provided to you during integration
  2. Decode the base64 signature from the header
  3. Create a SHA-256 hash of the request body
  4. Verify the signature using the public key and the hash

If the signature verification succeeds, the webhook is authentic. If not, it should be rejected.

Body

application/json
​
timestamp
string<date-time>
required

ISO8601 timestamp when the webhook was sent (can be used to prevent replay attacks)

Example:

"2025-08-15T14:32:00Z"

​
webhookId
string
required

Unique identifier for this webhook delivery (can be used for idempotency)

Example:

"Webhook:019542f5-b3e7-1d02-0000-000000000007"

​
type
enum<string>
required

Type of webhook event

Available options:
INCOMING_PAYMENT,
OUTGOING_PAYMENT,
TEST,
BULK_UPLOAD,
INVITATION_CLAIMED,
KYC_STATUS,
ACCOUNT_STATUS
​
transaction
object
required
​
requestedReceiverCustomerInfoFields
object[]

Information required by the sender's VASP about the recipient. Platform must provide these in the 200 OK response if approving. Note that this only includes fields which Grid does not already have from initial customer registration.

Response

Webhook received successfully. For PENDING transactions, this indicates approval to proceed with the payment. If requestedReceiverCustomerInfoFields were present in the webhook request, the corresponding fields for the recipient must be included in this response in the receiverCustomerInfo object.

​
receiverCustomerInfo
object

Information about the recipient, provided by the platform if requested in the webhook via requestedReceiverCustomerInfoFields and the payment is approved.

⌘I