Webhooks

Events include invoice.created, invoice.confirming, invoice.paid, invoice.underpaid, invoice.overpaid, invoice.expired, invoice.needs_review, invoice.unexpected_transfer, invoice.test, deposit.confirming, deposit.confirmed and deposit.unexpected. Dust deposits (under 0.5 USD) send no webhook. A deposit address created with its own webhookUrl receives its events there. The signature header is cryptox-signature: t=<unix>,v1=<hex>. The signed string is the timestamp, a period, and the raw body. Deliveries are sent with User-Agent Zenvault-Webhooks/1.0; the cryptox-signature and cryptox-event-id header names are kept for compatibility with existing integrations.

Reject signatures outside a five-minute window. Use a constant-time compare. Retries run after about 1 minute, 5 minutes, 15 minutes, 1 hour, and 6 hours. Return 2xx quickly and treat the event ID as idempotent. Delivery history shows status codes and a short summary, not the payload.

No webhook is sent for a deposit that was not detected. Warning: on BSC mainnet, BNB sent through an internal transaction (for example from a smart contract or some exchange withdrawals) may currently not be detected automatically. Ask customers to send BNB as a normal transfer. If a deposit is missing, contact support or file a recovery request with the transaction hash.