Skip to navigation
APIWebhook Events

spread.finalized

Fires once per finalize: an analyst finalized a spread, the final and machine attribute snapshots were created, and the board was locked. The payload carries ids, not figures. Fetch the figures from GET /api/loans/{loan_id}/attributes/{snapshot_id}.

Headers

SpreadSpace-SignaturestringRequired

Signature over the exact request body: t=<seconds since the Unix epoch>,v1=<lowercase hex HMAC-SHA256 of "{t}.{body}" keyed with your endpoint's signing secret>. Verify it before trusting the body, and reject a t more than five minutes from your own clock. During a secret rotation both the new and the previous secret verify for 24 hours; each delivery is signed with exactly one.

SpreadSpace-Event-IdstringRequiredformat: "^evt_[0-9a-f]{24}$"

The event id, identical to the body’s id. Stable across retries and replays, and shared by every endpoint one event fans out to. Delivery is at-least-once, so dedupe on it.

Payload

The payload of this webhook request is an object.
idstringRequiredformat: "^evt_[0-9a-f]{24}$"

Event id: evt_ plus 24 lowercase hex characters. Also sent as the SpreadSpace-Event-Id header. Stable across retries and replays, so dedupe on it.

typeenumRequired
Always this event type on this body.
Allowed values:
createdlongRequired

Seconds since the Unix epoch at which the event was created server-side. Seconds, not milliseconds. Deliveries are not ordered; reconcile on this.

tenant_idstringRequired
The workspace the event belongs to. Reject a delivery whose tenant does not match the endpoint you registered.
livemodebooleanRequired

true for live activity, false for test mode (an ss_test_ key or the sandbox simulator). Branch on it to route test deliveries to a staging handler.

dataobjectRequired

The data object on a spread.finalized delivery, sent once per finalize: an analyst pressed Finalize on a saved spread board, the server minted the loan’s machine snapshot (documents only) and then its final snapshot (the frozen working values), and locked the board.

A pointer, not a payload: ids and the version only, no figures and no names. The frozen values are served by the authenticated GET /api/loans/{loan_id}/attributes (latest final) or GET /api/loans/{loan_id}/attributes/{snapshot_id}, where the caller’s own scope and plan apply.

Response

2XX
Return any 2xx within 5 seconds. A 4xx other than 429 stops retries for that delivery. 429, 5xx, network errors and timeouts are retried, up to 12 attempts in all.