Skip to main content

​
Overview

Ovra sends HTTP POST requests to your endpoints when events occur — transactions, intent approvals, card changes, and more.

​
Setup

curl -X POST https://api.getovra.com/webhooks \
  -H "Authorization: Bearer sk_test_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.com/webhook",
    "events": ["transaction.completed", "intent.approved", "intent.denied"]
  }'

​
Events

EventWhen
transaction.completedAgent completed a payment
intent.createdNew intent declared
intent.approvedIntent was approved (auto or manual)
intent.deniedIntent was denied by policy
intent.expiredIntent TTL expired
card.frozenCard was frozen
card.unfrozenCard was reactivated
card.closedCard was permanently closed
agent.createdNew agent created
agent.frozenAgent was frozen

​
Verification

Every webhook includes an HMAC signature: 
X-Ovra-Signature: sha256=...
X-Ovra-Timestamp: 1711036800
Verify by computing HMAC-SHA256 of the raw body with your webhook secret.

​
Retry Policy

Failed deliveries are retried with exponential backoff:
  • 1 minute, 5 minutes, 15 minutes, 1 hour, 4 hours
  • Max 5 attempts per delivery