curl --request POST \
--url https://api.malvo.io/webhooks \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: <api-key>' \
--data '
{
"url": "https://api.your-app.com/webhooks/malvo",
"event": "all",
"headers": {
"Authorization": "Bearer <your-shared-secret>",
"X-CLIENT-ID": "<secret>"
}
}
'const options = {
method: 'POST',
headers: {'X-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
url: 'https://api.your-app.com/webhooks/malvo',
event: 'all',
headers: {Authorization: 'Bearer <your-shared-secret>', 'X-CLIENT-ID': '<secret>'}
})
};
fetch('https://api.malvo.io/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.malvo.io/webhooks"
payload = {
"url": "https://api.your-app.com/webhooks/malvo",
"event": "all",
"headers": {
"Authorization": "Bearer <your-shared-secret>",
"X-CLIENT-ID": "<secret>"
}
}
headers = {
"X-API-KEY": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.malvo.io/webhooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => 'https://api.your-app.com/webhooks/malvo',
'event' => 'all',
'headers' => [
'Authorization' => 'Bearer <your-shared-secret>',
'X-CLIENT-ID' => '<secret>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-KEY: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"id": "39e1d11f-3c12-44a8-a788-75c5747e1a8e",
"event": "all",
"url": "https://api.your-app.com/webhooks/malvo",
"createdAt": "2026-06-10T12:00:00.000Z",
"updatedAt": "2026-06-10T12:00:00.000Z",
"disabled": null
}Criar webhook
Registra um novo webhook na sua aplicação. A url deve usar https:// e não pode ser localhost/host privado. O event deve ser um valor válido do enum (all cobre todos os eventos disparados). O campo headers é write-only: aceito aqui, mas nunca retornado.
Dica: prefira event: "all" com um único endpoint e roteie internamente, evitando o limite de 5 webhooks por tipo de evento.
curl --request POST \
--url https://api.malvo.io/webhooks \
--header 'Content-Type: application/json' \
--header 'X-API-KEY: <api-key>' \
--data '
{
"url": "https://api.your-app.com/webhooks/malvo",
"event": "all",
"headers": {
"Authorization": "Bearer <your-shared-secret>",
"X-CLIENT-ID": "<secret>"
}
}
'const options = {
method: 'POST',
headers: {'X-API-KEY': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
url: 'https://api.your-app.com/webhooks/malvo',
event: 'all',
headers: {Authorization: 'Bearer <your-shared-secret>', 'X-CLIENT-ID': '<secret>'}
})
};
fetch('https://api.malvo.io/webhooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.malvo.io/webhooks"
payload = {
"url": "https://api.your-app.com/webhooks/malvo",
"event": "all",
"headers": {
"Authorization": "Bearer <your-shared-secret>",
"X-CLIENT-ID": "<secret>"
}
}
headers = {
"X-API-KEY": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.malvo.io/webhooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'url' => 'https://api.your-app.com/webhooks/malvo',
'event' => 'all',
'headers' => [
'Authorization' => 'Bearer <your-shared-secret>',
'X-CLIENT-ID' => '<secret>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-KEY: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"id": "39e1d11f-3c12-44a8-a788-75c5747e1a8e",
"event": "all",
"url": "https://api.your-app.com/webhooks/malvo",
"createdAt": "2026-06-10T12:00:00.000Z",
"updatedAt": "2026-06-10T12:00:00.000Z",
"disabled": null
}Authorizations
Chave de API da aplicação (TTL de 2h). Renove via POST /auth com clientId/clientSecret. Em caso de 401, regenere a apiKey.
Body
Corpo para criar um webhook.
URL de destino. Deve ser https:// e não pode ser localhost/host privado.
"https://api.your-app.com/webhooks/malvo"
Tipo de evento a assinar. Aceita qualquer valor do enum.
all, item/created, item/updated, item/error, item/deleted, item/waiting_user_input, item/login_succeeded, transactions/created, transactions/updated, transactions/deleted, connector/status_updated, payment_intent/created, payment_intent/waiting_payer_authorization, payment_intent/completed, payment_intent/error, scheduled_payment/created, scheduled_payment/completed, scheduled_payment/error, scheduled_payment/canceled, automatic_pix_payment/created, automatic_pix_payment/completed, automatic_pix_payment/error, automatic_pix_payment/canceled, smart_transfer_preauthorization/completed, smart_transfer_preauthorization/error, smart_transfer_payment/completed, smart_transfer_payment/error, payment_request/updated "all"
Write-only / API-only. Mapa nome→valor de headers enviados verbatim em cada entrega. Nunca é retornado em respostas nem visível/editável no Dashboard. Use para autenticação das entregas (ex.: Authorization: Bearer ...).
Show child attributes
Show child attributes
{
"Authorization": "Bearer <your-shared-secret>",
"X-CLIENT-ID": "<secret>"
}
Response
Webhook criado. O corpo é o objeto Webhook (sem headers).
Webhook registrado na aplicação. O campo headers é write-only e nunca aparece neste objeto de resposta.
Identificador único do webhook, gerado pela Malvo.
"39e1d11f-3c12-44a8-a788-75c5747e1a8e"
Tipo de evento assinado (um valor do enum, incluindo all).
all, item/created, item/updated, item/error, item/deleted, item/waiting_user_input, item/login_succeeded, transactions/created, transactions/updated, transactions/deleted, connector/status_updated, payment_intent/created, payment_intent/waiting_payer_authorization, payment_intent/completed, payment_intent/error, scheduled_payment/created, scheduled_payment/completed, scheduled_payment/error, scheduled_payment/canceled, automatic_pix_payment/created, automatic_pix_payment/completed, automatic_pix_payment/error, automatic_pix_payment/canceled, smart_transfer_preauthorization/completed, smart_transfer_preauthorization/error, smart_transfer_payment/completed, smart_transfer_payment/error, payment_request/updated "all"
URL HTTPS de destino, validada no momento de criar/atualizar.
"https://api.your-app.com/webhooks/malvo"
Data/hora de criação (ISO 8601, UTC, milissegundos).
"2026-06-10T12:00:00.000Z"
Data/hora da última atualização (ISO 8601, UTC, milissegundos).
"2026-06-10T12:00:00.000Z"
Timestamp (ISO 8601) de quando o webhook foi desabilitado; null quando ativo. Configurável via PATCH.
null