> ## Documentation Index > Fetch the complete documentation index at: https://partners.ladder.africa/llms.txt > Use this file to discover all available pages before exploring further. # Register a webhook endpoint > HTTPS only for live keys; the host must resolve to public IPs. `events` empty = all events. Max 5 per environment. The `secret` is returned only in this response. ## OpenAPI ````yaml /openapi.json post /partner/v1/webhooks openapi: 3.0.3 info: title: Ladder Partner API version: v1 description: >- Server-to-server API for licensed partner organisations: KYB, NGN/GHS/USD wallets, funding rails, investments and NGX market data, buy and sell orders, holdings and webhooks. Every request is HMAC-signed; see the Authentication guide. contact: email: partners@myladder.africa servers: - url: https://api.myladder.africa description: Production - url: https://api-dev.myladder.africa description: UAT (integration and acceptance testing) security: - LadderKey: [] LadderTimestamp: [] LadderSignature: [] tags: - name: Organisation description: The calling organisation and what KYB still needs. - name: KYB description: >- Business information, people, documents, settlement accounts and submission. - name: Wallets description: >- Balances, funding requests on every rail, direct-debit mandates and the ledger statement. - name: Investments description: What a partner can buy. - name: Market data description: >- Nigerian Exchange instruments, quotes, bars, indices, FX, calendar and disclosures. - name: Orders description: Buy and sell orders and their lifecycle. - name: Holdings description: Positions created by completed buys. - name: Webhooks description: Endpoints, deliveries and retries. - name: Sandbox description: Test-key only helpers. paths: /partner/v1/webhooks: parameters: [] post: tags: - Webhooks summary: Register a webhook endpoint description: >- HTTPS only for live keys; the host must resolve to public IPs. `events` empty = all events. Max 5 per environment. The `secret` is returned only in this response. operationId: webhooks_create parameters: - name: Idempotency-Key in: header description: >- Unique per logical request (max 255 chars). A retry with the same key and body returns the original response with `Idempotent-Replayed: true`; a different body returns 409. required: true schema: type: string requestBody: $ref: '#/components/requestBodies/PartnerWebhookEndpoint' responses: '201': description: '' content: application/json: schema: $ref: '#/components/schemas/PartnerWebhookEndpointWithSecretResponse' '400': description: Validation or business-rule error (see `error.code`). content: application/json: schema: $ref: '#/components/schemas/PartnerError' '401': description: Missing/invalid signature, stale timestamp, unknown or revoked key. content: application/json: schema: $ref: '#/components/schemas/PartnerError' '403': description: IP not allowlisted, or action not allowed for this key/environment. content: application/json: schema: $ref: '#/components/schemas/PartnerError' '404': description: Not found (or belongs to another organisation/environment). content: application/json: schema: $ref: '#/components/schemas/PartnerError' '429': description: Rate limited (120 requests/min per key). See `Retry-After`. content: application/json: schema: $ref: '#/components/schemas/PartnerError' components: requestBodies: PartnerWebhookEndpoint: content: application/json: schema: $ref: '#/components/schemas/PartnerWebhookEndpoint' required: true schemas: PartnerWebhookEndpointWithSecretResponse: required: - data type: object properties: data: $ref: '#/components/schemas/PartnerWebhookEndpointWithSecret' PartnerError: required: - error type: object properties: error: $ref: '#/components/schemas/PartnerErrorBody' PartnerWebhookEndpoint: required: - url type: object properties: id: title: Id type: string format: uuid readOnly: true url: title: Url type: string format: uri maxLength: 500 minLength: 1 description: title: Description type: string maxLength: 255 events: type: array items: type: string enum: - wallet.funded - funding.failed - funding.expired - mandate.activated - mandate.revoked - order.created - order.processing - order.completed - order.failed - order.cancelled - holding.matured - kyb.status_changed enabled: title: Enabled type: boolean created_at: title: Created_at type: string format: date-time readOnly: true updated_at: title: Updated at type: string format: date-time readOnly: true PartnerWebhookEndpointWithSecret: required: - url - secret type: object properties: id: title: Id type: string format: uuid readOnly: true url: title: Url type: string format: uri maxLength: 500 minLength: 1 description: title: Description type: string maxLength: 255 events: type: array items: type: string enum: - wallet.funded - funding.failed - funding.expired - mandate.activated - mandate.revoked - order.created - order.processing - order.completed - order.failed - order.cancelled - holding.matured - kyb.status_changed enabled: title: Enabled type: boolean created_at: title: Created_at type: string format: date-time readOnly: true updated_at: title: Updated at type: string format: date-time readOnly: true secret: title: Secret description: '`whsec_…` signing secret. Returned only here; store it.' type: string minLength: 1 PartnerErrorBody: required: - code - message - details type: object properties: code: title: Code description: Stable machine-readable code, e.g. `insufficient_funds`. type: string minLength: 1 message: title: Message type: string minLength: 1 details: title: Details description: Code-specific context (validation errors, balances, …). type: object additionalProperties: type: string nullable: true securitySchemes: LadderKey: type: apiKey in: header name: X-Ladder-Key description: 'Your key id: `pk_test_…` (sandbox) or `pk_live_…` (live).' LadderTimestamp: type: apiKey in: header name: X-Ladder-Timestamp description: Unix seconds, as a string; must be within 5 minutes of server time. LadderSignature: type: apiKey in: header name: X-Ladder-Signature description: >- Lower-case hex HMAC-SHA512 over timestamp, method, path+query and the SHA-256 of the body. See Authentication. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.