Webhooks

Manage webhook subscriptions and inspect the delivery event log. Create subscriptions to receive real-time notifications for case lifecycle events, payments, and chats. Use GET /webhooks/events to verify deliveries and POST /webhooks/events/{id}/replay to re-deliver a specific event.

Base URL: https://collectionpartner-api.debitura.com
Authentication: API key in the XApiKey header

List all webhook subscriptions for the authenticated collection partner.

GET/webhooks

Returns all webhook subscriptions for the authenticated collection partner. Secrets are never returned in list operations.

Returns

200 List of webhook subscriptions — a list of the objects below.

iduuid
urlstringnullable
eventsarray of stringsnullable
isActiveboolean
createdUtcdatetime
updatedUtcdatetime
disabledReasonstringnullable
secretstringnullable
isTestModeboolean

Errors

401 API key is missing or invalid

See Error handling.

GET/webhooks

curl https://collectionpartner-api.debitura.com/webhooks \
  -H "XApiKey: $DEBITURA_API_KEY"

Response

[
  {
    "id": "3f2b6c1e-8a4d-4b7f-9c2e-5d1a0b9e7f31",
    "url": "https://app.debitura.com/…",
    "events": [
      "string"
    ],
    "isActive": true,
    "createdUtc": "2026-10-01T14:05:00Z",
    "updatedUtc": "2026-10-01T14:05:00Z",
    "disabledReason": null,
    "secret": "string",
    "isTestMode": true
  }
]

Create a new webhook subscription.

POST/webhooks

Creates a new webhook subscription for receiving real-time event notifications.

Available Events (assigned/working-partner role):

case.assigned - Case validated by Debitura and assigned to your agency
case.updated - Case lifecycle changed (e.g., Active → Paused). Does not cover engagement phase changes (Pre-legal/Legal/Enforcement) — poll GET /cases/{id} or GET /cases/{id}/timeline for the current phase; there is no phase-change event today.
case.closed - Case closed
payment.created - Payment registered on case
payment.deleted - Payment reversed (deleted) on case
chat.created - Chat message created on case

Managing-role events (explicit opt-in): managed_case.created, managed_case.assigned, managed_case.updated, managed_case.closed, managed_case.declined, managed_case.payment.created, managed_case.payment.deleted, managed_case.chat.created. You may configure these subscriptions before managing-webhook delivery is enabled. Notifications remain inactive until enabled; synthetic managed fire returns 422 while disabled. Notifications contain minimal event facts; chat body and close/decline comments are omitted. Detailed content uses the authorized managing-case API. Managed chat notifications and history require the current active engagement. Payment deletion repeats the original payment snapshot; the event name identifies its reversal. Existing subscriptions are never automatically opted in.

Security: Response includes Base64-encoded signing secret (shown only once). Store it to verify HMAC-SHA256 signatures on deliveries.

Requirements: HTTPS URL required. Deliveries retry with exponential backoff (8 attempts). Webhook auto-disables after max failures.

Request body

urlstringRequired
Max 800 characters · URL
eventsarray of stringsRequired
isTestModeboolean

Returns

201 Webhook created successfully

iduuid
urlstringnullable
eventsarray of stringsnullable
isActiveboolean
createdUtcdatetime
updatedUtcdatetime
disabledReasonstringnullable
secretstringnullable
isTestModeboolean

Errors

`400`	Invalid request
`401`	API key is missing or invalid
`422`	Business rule violation

See Error handling.

POST/webhooks

curl -X POST https://collectionpartner-api.debitura.com/webhooks \
  -H "XApiKey: $DEBITURA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/webhooks/debitura",
    "events": [
      "string"
    ]
  }'

Response

{
  "id": "3f2b6c1e-8a4d-4b7f-9c2e-5d1a0b9e7f31",
  "url": "https://app.debitura.com/…",
  "events": [
    "string"
  ],
  "isActive": true,
  "createdUtc": "2026-10-01T14:05:00Z",
  "updatedUtc": "2026-10-01T14:05:00Z",
  "disabledReason": null,
  "secret": "string",
  "isTestMode": true
}

Get a specific webhook subscription by ID.

GET/webhooks/{id}

Returns details of a specific webhook subscription. Secret is never returned in this operation.

Path parameters

iduuidRequired
The unique identifier of the webhook subscription.

Returns

200 Webhook subscription found

iduuid
urlstringnullable
eventsarray of stringsnullable
isActiveboolean
createdUtcdatetime
updatedUtcdatetime
disabledReasonstringnullable
secretstringnullable
isTestModeboolean

Errors

`401`	API key is missing or invalid
`404`	Webhook not found

See Error handling.

GET/webhooks/{id}

curl https://collectionpartner-api.debitura.com/webhooks/3f2b6c1e-8a4d-4b7f-9c2e-5d1a0b9e7f31 \
  -H "XApiKey: $DEBITURA_API_KEY"

Response

{
  "id": "3f2b6c1e-8a4d-4b7f-9c2e-5d1a0b9e7f31",
  "url": "https://app.debitura.com/…",
  "events": [
    "string"
  ],
  "isActive": true,
  "createdUtc": "2026-10-01T14:05:00Z",
  "updatedUtc": "2026-10-01T14:05:00Z",
  "disabledReason": null,
  "secret": "string",
  "isTestMode": true
}

Update an existing webhook subscription.

PUT/webhooks/{id}

Updates webhook URL, events, or active status. Set RegenerateSecret=true to rotate signing secret (returned in response). Use IsActive=true to re-enable auto-disabled webhooks after fixing delivery issues. Secret only included if RegenerateSecret=true.

Path parameters

iduuidRequired
The unique identifier of the webhook subscription to update.

Request body

urlstringnullable
Max 800 characters · URL
eventsarray of stringsnullable
isActivebooleannullable
regenerateSecretboolean
isTestModebooleannullable

Returns

200 Webhook updated successfully

iduuid
urlstringnullable
eventsarray of stringsnullable
isActiveboolean
createdUtcdatetime
updatedUtcdatetime
disabledReasonstringnullable
secretstringnullable
isTestModeboolean

Errors

`400`	Invalid request
`401`	API key is missing or invalid
`404`	Webhook not found

See Error handling.

PUT/webhooks/{id}

curl -X PUT https://collectionpartner-api.debitura.com/webhooks/3f2b6c1e-8a4d-4b7f-9c2e-5d1a0b9e7f31 \
  -H "XApiKey: $DEBITURA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

Response

{
  "id": "3f2b6c1e-8a4d-4b7f-9c2e-5d1a0b9e7f31",
  "url": "https://app.debitura.com/…",
  "events": [
    "string"
  ],
  "isActive": true,
  "createdUtc": "2026-10-01T14:05:00Z",
  "updatedUtc": "2026-10-01T14:05:00Z",
  "disabledReason": null,
  "secret": "string",
  "isTestMode": true
}

Delete a webhook subscription.

DELETE/webhooks/{id}

Permanently deletes webhook subscription. Cannot be undone. Consider setting IsActive=false to temporarily disable instead.

Path parameters

iduuidRequired
The unique identifier of the webhook subscription to delete.

Returns

204 Webhook deleted successfully — no response body.

Errors

`401`	API key is missing or invalid
`404`	Webhook not found

See Error handling.

DELETE/webhooks/{id}

curl -X DELETE https://collectionpartner-api.debitura.com/webhooks/3f2b6c1e-8a4d-4b7f-9c2e-5d1a0b9e7f31 \
  -H "XApiKey: $DEBITURA_API_KEY"

Response

204 Webhook deleted successfully. No response body.