Slash API: Receiving Real-Time Webhook Notifications

Overview

Webhooks let you receive automatic notifications when events happen in your Slash account. Instead of polling the API for changes, Slash sends a request directly to your server whenever a card or transaction status changes.

Supported Event Types

• card.update — Triggered when a card's details or status changes
• card.delete — Triggered when a card is deleted
• card_creation.event — Triggered when a new card is created
• aggregated_transaction.create — Triggered when a new transaction is created
• aggregated_transaction.update — Triggered when a transaction's status or details change

How Webhook Events Work

Webhook events contain metadata about what changed (entity ID, event type, event ID) but do not include the full entity data. To get the current state of the entity, make a follow-up GET request to the corresponding endpoint using the entityId from the event.

Setting Up Webhooks

Step 1: Create a Webhook Endpoint

Send a POST request to https://api.joinslash.com/webhook with the URL you want Slash to send events to, and a name to identify the endpoint. If you're authenticating via OAuth (not an API key), you'll also need to include a legalEntityId.

Step 2: Verify Webhook Signatures

Every webhook request includes a slash-webhook-signature header. Verify this signature using Slash's public RSA key to ensure the request is genuinely from Slash and hasn't been tampered with.

Step 3: Return a 2xx Response

Your endpoint must respond with a 2xx status code within 10 seconds. If it doesn't, Slash treats the delivery as a failure and will retry.

Managing Webhook Endpoints

You can list all your webhook endpoints with GET /webhook, or fetch a specific one with GET /webhook/{webhookId}.

To change an endpoint's status, use PATCH /webhook/{webhookId}. You can set it to:

• active — Enables the endpoint. Also use this to re-enable an endpoint that has been paused or automatically disabled.
• paused — Pauses the endpoint. Events are queued (not lost) and will be delivered when you set it back to active.
• archived — Permanently archives the endpoint.

You may also see two system-managed statuses: backing-off (temporarily paused due to delivery failures, will auto-retry) and disabled (automatically disabled after repeated failures). In either case, set the status to active to re-enable and process any queued events.

Retries, Ordering, and Idempotency

If your endpoint fails to respond, Slash retries delivery with exponential backoff. After repeated failures, the endpoint enters a backing-off state, and eventually gets disabled if failures continue. Queued events are not lost — re-enabling the endpoint will trigger delivery of any pending events.

Events may be delivered out of order or more than once. Use the eventId field as an idempotency key to detect and handle duplicate deliveries in your application.

Authorization Webhooks

Authorization webhooks let you approve or decline card transactions in real-time before they're authorized. Unlike notification webhooks, your server must respond with an approval or decline decision within the timeout window.

You can configure authorization webhooks through the API:

• View your configuration: GET /account/{accountId}/authorization-webhook
• Set up or replace: PUT /account/{accountId}/authorization-webhook
• Update settings: PATCH /account/{accountId}/authorization-webhook

Need More Help?

For the full API reference, visit https://api.joinslash.com/openapi. For help configuring webhooks or troubleshooting delivery issues, contact Slash support at support@slash.com or use the in-app chat in your dashboard.