memo.finalized
Fires once per finalize: an analyst finished a credit memo, it was locked, and its final PDF was made. The payload carries ids, not the memo. Pull the PDF from GET /api/loans/{loanId}/memos/{memoId}/pdf.
Fires once per finalize: an analyst finished a credit memo, it was locked, and its final PDF was made. The payload carries ids, not the memo. Pull the PDF from GET /api/loans/{loanId}/memos/{memoId}/pdf.
Signature over the exact request body: t=<seconds since the Unix epoch>,v1=<lowercase hex HMAC-SHA256 of "{t}.{body}" keyed with your endpoint's signing secret>. Verify it before trusting the body, and reject a t more than five minutes from your own clock. During a secret rotation both the new and the previous secret verify for 24 hours; each delivery is signed with exactly one.
The event id, identical to the body’s id. Stable across retries and replays, and shared by every endpoint one event fans out to. Delivery is at-least-once, so dedupe on it.
Event id: evt_ plus 24 lowercase hex characters. Also sent as the SpreadSpace-Event-Id header. Stable across retries and replays, so dedupe on it.
Seconds since the Unix epoch at which the event was created server-side. Seconds, not milliseconds. Deliveries are not ordered; reconcile on this.
true for live activity, false for test mode (an ss_test_ key or the sandbox simulator). Branch on it to route test deliveries to a staging handler.
The data object on a memo.finalized delivery, sent once per
finalize: an analyst finished a credit memo and its final PDF is made. The
memo is locked until someone reopens it, so what this points at is the
deal’s finished document.
A pointer, not a payload: ids and the time only, never the memo’s prose.
Pull the PDF through
GET /api/loans/{loanId}/memos/{memoId}/pdf.