WEBHOOK

Authorizations

X-DimeTrades-Signature
string
header
required

HMAC request/delivery signature — not a bearer token or API key. The actual proof a call came from DimeTrades — verify it.

Used on webhook deliveries and on the external-wallet reservation check: t=<unix seconds>,v1=<hex HMAC-SHA256>, where v1 is HMAC-SHA256(secret, "{t}.{rawBody}") over the exact raw body sent. Webhook deliveries are signed with your webhook signing secret; the reservation check is signed with your separate external wallet secret. Verify the signature and reject stale timestamps before trusting the payload — full steps in the Partner webhooks guide's "Verifying a delivery" section. Neither of these calls carries X-API-Key — that identifies a platform calling DimeTrades; here DimeTrades is calling you, with its own identity proven by this signature, not by any header, alone.

The reservation check also carries Authorization: Bearer {partnerApiKeyId}, but that header is not part of authentication — partnerApiKeyId is a plain identifier your brand's admin typed into DimeTrades's settings, not issued or cryptographically verified by DimeTrades, and it's optional on the brand's side. Treat this signature as the only thing that actually proves the call is legitimate; see the reservation check's own "Authenticating the request" section for that header's details.

Body

application/json

The payload DimeTrades sends to your webhookUrl.

Every webhook delivery shares this envelope. id is stable across retries — use it to dedupe. data varies per type; see each webhook page.

id
string<uuid>
required

Stable per-event id. Identical across delivery retries — dedupe on this.

type
string
required

One of the webhook event names, e.g. order.filled, trade.executed.

createdAt
string<date-time>
required
data
WalletCreditTradeData · object
required

Event-specific payload — see the individual webhook for its shape. Every order.*, trade.executed and wallet.* event carries orderId, clientOrderId (the key you supplied on POST /orders; null only for an order placed without one), marketId, eventId (the event the market belongs to) and externalCustomerId (your own id for the customer, as supplied when you registered them), so you can correlate on your own keys without a lookup. The exception is a wallet.credit with reason: market_settlement, which has no order behind it and carries marketId and positionId instead.

Response

200

Return any 2xx to acknowledge receipt. Anything else (including a timeout) is treated as a delivery failure and retried.