Webhook notifications

For users who have been registered through a Partner, webhook notifications are sent instead of standard emails. These notifications are sent to a URL provided by the Partner. It is the Partner's responsibility to notify end-users in response to webhook notifications. TÝR Markets will never contact the Partner's users by email, even when sending mass emails (e.g. newsletter, announcements, T&C updates, etc.).

All notifications will be sent using the following format:

POST <<Webhook URL>>
Content-Type: application/json
X-Webhook-Timestamp: <<Request timestamp>>
X-Webhook-Signature: <<HMAC signature of the request>>
{
  "notificationType": "<<notification type>>"
  <<Notification specific fields>>
}

For example:

POST https://partner-site.com/tyr-markets-notifications
Content-Type: application/json
X-Webhook-Timestamp: 1787142319072
X-Webhook-Signature: Cb89j6Uofh+ka5ZlwcDw/nam/ib3YlZOkJhT54WiSR0=
{
  "notificationType": "DEPOSIT_CONFIRMED",
  "volvenUserId": "7647",
  "transferId": "11950943-12d0-4d5a-b022-2fb2d8ee2406",
  "source": "9GpHcZdNGJ28XaYPg31s6km63TnJx6qu2JDoyknMXtL1",
  "currency": "SOL",
  "amount": "32.6479599"
}

All notification payloads contain a notificationType field identifying the type of notification. Partners should use this field to determine how to process the notification.

Additional fields may be added to notification payloads in the future. Partners should ignore fields they do not recognise.

Body

The request body is a JSON object encoded as UTF-8.

Headers

Following HTTP headers will be present in every webhook notification:

• X-Webhook-Timestamp - request timestamp (Unix epoch milliseconds) Partners should verify that the timestamp is within a short time window of the current time (e.g. 15 seconds) to protect against replay attacks.

• X-Webhook-Signature - HMAC-SHA256 signature of the request, encoded using Base64

  It is calculated in following way:

  1. Prepare canonical request by concatenating X-Webhook-Timestamp header value and raw HTTP request body, for example: 1787142319072{"notificationType":"DEPOSIT_CONFIRMED",...}

  2. Sign canonical request with Partner's API Secret using HMAC-SHA256 algorithm

  3. Encode the signature in Base64 format.

  Partners should verify the signature to ensure that request comes from TÝR Markets.

The Partner API Secret used for webhook signature verification is the same API Secret associated with the Partner’s API Key.

Response

TÝR Markets will do following action based on the HTTP response code from the Partner:

• 200 - 299: mark the notification as delivered

• any other status code: mark the notification delivery as failed

• timeout / network error: mark the notification delivery as failed (may result with same notification being sent more than once)

In case of failed delivery TÝR Markets will retry sending notification to the Partner with linearly increasing backoff, starting with 1 minute and maximum of 100 attempts.

Note that response headers and body will be ignored

Notification types

The following notification types are currently supported:

User successfully created

{
  "notificationType": "USER_CREATED",
  "volvenUserId": "7647",
  "email": "[e-mail]"
}

User registration failed

{
  "notificationType": "SIGNUP_FAILED",
  "email": "[e-mail]",
  "errorMessage": "Error details"
}

Deposit confirmed

{
  "notificationType": "DEPOSIT_CONFIRMED",
  "volvenUserId": "7647",
  "transferId": "11950943-12d0-4d5a-b022-2fb2d8ee2406",
  "source": "9GpHcZdNGJ28XaYPg31s6km63TnJx6qu2JDoyknMXtL1",
  "currency": "SOL",
  "amount": "32.6479599"
}

Withdrawal confirmed

{
  "notificationType": "WITHDRAWAL_CONFIRMED",
  "volvenUserId": "7647",
  "transferId": "11950943-12d0-4d5a-b022-2fb2d8ee2406",
  "target": "9GpHcZdNGJ28XaYPg31s6km63TnJx6qu2JDoyknMXtL1",
  "currency": "SOL",
  "amount": "32.6479599"
}

Withdrawal failed

{
  "notificationType": "WITHDRAWAL_FAILED",
  "volvenUserId": "7647",
  "transferId": "11950943-12d0-4d5a-b022-2fb2d8ee2406",
  "target": "9GpHcZdNGJ28XaYPg31s6km63TnJx6qu2JDoyknMXtL1",
  "currency": "SOL",
  "amount": "32.6479599"
}

Withdrawal canceled

{
  "notificationType": "WITHDRAWAL_CANCELED",
  "volvenUserId": "7647",
  "transferId": "11950943-12d0-4d5a-b022-2fb2d8ee2406",
  "target": "9GpHcZdNGJ28XaYPg31s6km63TnJx6qu2JDoyknMXtL1",
  "currency": "SOL",
  "amount": "32.6479599"
}

New notification types may be introduced in the future. Partners must ignore notification types they do not recognise.