Webhooks

POST /api/v1/webhooks
{ "url": "https://your-app.com/hooks/trustlayer", "description": "Orders" }

Store signing_secret (whsec_…) — shown once.

Headers

user-agent: TrustLayer-Webhooks/1.0

x-trustlayer-signature: sha256=<hex>

Verify

HMAC-SHA256(rawBody, signing_secret) as hex
Compare to header value after "sha256="

Use raw body bytes. Events include type deal.created, deal.finalized, deal_id, external_id.