Skip to navigation
APIWebhook Events

memo.finalized

Fires once per finalize: an analyst finished a credit memo, it was locked, and its final PDF was made. The payload carries ids, not the memo. Pull the PDF from GET /api/loans/{loan_id}/memos/{memo_id}/pdf.

Headers

SpreadSpace-SignaturestringRequired

Signature over the exact request body: t=<seconds since the Unix epoch>,v1=<lowercase hex HMAC-SHA256 of "{t}.{body}" keyed with your endpoint's signing secret>. Verify it before trusting the body, and reject a t more than five minutes from your own clock. During a secret rotation both the new and the previous secret verify for 24 hours; each delivery is signed with exactly one.

SpreadSpace-Event-IdstringRequiredformat: "^evt_[0-9a-f]{24}$"

The event id, identical to the body’s id. Stable across retries and replays, and shared by every endpoint one event fans out to. Delivery is at-least-once, so dedupe on it.

Payload

The payload of this webhook request is an object.
idstringRequiredformat: "^evt_[0-9a-f]{24}$"

Event id: evt_ plus 24 lowercase hex characters. Also sent as the SpreadSpace-Event-Id header. Stable across retries and replays, so dedupe on it.

typeenumRequired
Always this event type on this body.
Allowed values:
created_atdatetimeRequired

Server-side wall-clock time the event was created, RFC 3339. Deliveries are not ordered; reconcile on this.

tenant_idstringRequired
The workspace the event belongs to. Reject a delivery whose tenant does not match the endpoint you registered.
livemodebooleanRequired

true for live activity, false for test mode (an ss_test_ key or the sandbox simulator). Branch on it to route test deliveries to a staging handler.

dataobjectRequired

The data object on a memo.finalized delivery, sent once per finalize: an analyst finished a credit memo and its final PDF is made. The memo is locked until someone reopens it, so what this points at is the deal’s finished document.

A pointer, not a payload: ids, the time and the spread snapshots the memo was approved on, never the memo’s prose or its figures. Pull the PDF through GET /api/loans/{loan_id}/memos/{memo_id}/pdf.

api_versionstringOptionalformat: "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"

The API version the delivery was rendered under, a date stamp: the same value /v1/openapi.json reports as info.version. The envelope and data have that version’s shape, and a breaking change ships under a new stamp. A delivery recorded before this field existed carries none, and has the 2026-10-07 shape.

Response

2XX
Return any 2xx within 5 seconds. A 4xx other than 429 stops retries for that delivery. 429, 5xx, network errors and timeouts are retried, up to 12 attempts in all.