{
"id": "54b1fca5-697c-4b22-937f-e78abb9bb42f",
"type": "order.filled",
"createdAt": "2026-08-10T17:51:34.103Z",
"data": {
"orderId": "019f2d10-aaaa-733c-b8af-42a3620ee999",
"clientOrderId": "my-app-order-8f3e2a1b",
"externalCustomerId": "cust-92",
"marketId": 60497,
"eventId": 5454,
"quantityFilled": 10,
"remainingQuantity": 0,
"avgFillPrice": 46
}
}Order fully filled
Terminal — the order reached quantityFilled === quantity. For the trade-level view of the fill(s) that produced this, see trade.executed.
Delivered async, signed, at-least-once. Every delivery carries:
X-DimeTrades-Event-Id: 54b1fca5-697c-4b22-937f-e78abb9bb42f
X-DimeTrades-Event-Type: order.filled
X-DimeTrades-Signature: t=1786384403,v1=6ac323d7d75b7e9f6cbfce6acc19edc657798f1e30dcd00c933cba5a4000a58b
v1 is HMAC-SHA256(webhookSecret, "{t}.{rawBody}"), hex-encoded. Verify it, and reject stale timestamps, before trusting the payload. Retried with exponential backoff (30s -> 2m -> 10m -> 1h -> 6h) up to 8 attempts if your endpoint doesn’t return 2xx; dedupe on id since a retried delivery reuses the same event id. Full details in the Partner webhooks guide.
{
"id": "54b1fca5-697c-4b22-937f-e78abb9bb42f",
"type": "order.filled",
"createdAt": "2026-08-10T17:51:34.103Z",
"data": {
"orderId": "019f2d10-aaaa-733c-b8af-42a3620ee999",
"clientOrderId": "my-app-order-8f3e2a1b",
"externalCustomerId": "cust-92",
"marketId": 60497,
"eventId": 5454,
"quantityFilled": 10,
"remainingQuantity": 0,
"avgFillPrice": 46
}
}Authorizations
HMAC request/delivery signature — not a bearer token or API key. The actual proof a call came from DimeTrades — verify it.
Used on webhook deliveries and on the external-wallet reservation check:
t=<unix seconds>,v1=<hex HMAC-SHA256>, where v1 is
HMAC-SHA256(secret, "{t}.{rawBody}") over the exact raw body sent.
Webhook deliveries are signed with your webhook signing secret; the
reservation check is signed with your separate external wallet secret.
Verify the signature and reject stale timestamps before trusting the
payload — full steps in the Partner webhooks guide's "Verifying a
delivery" section. Neither of these calls carries X-API-Key — that
identifies a platform calling DimeTrades; here DimeTrades is calling
you, with its own identity proven by this signature, not by any
header, alone.
The reservation check also carries Authorization: Bearer {partnerApiKeyId}, but that header is not part of authentication —
partnerApiKeyId is a plain identifier your brand's admin typed into
DimeTrades's settings, not issued or cryptographically verified by
DimeTrades, and it's optional on the brand's side. Treat this signature
as the only thing that actually proves the call is legitimate; see the
reservation check's own "Authenticating the request" section for that
header's details.
Body
The payload DimeTrades sends to your webhookUrl.
Every webhook delivery shares this envelope. id is stable across retries — use it to dedupe. data varies per type; see each webhook page.
Stable per-event id. Identical across delivery retries — dedupe on this.
One of the webhook event names, e.g. order.filled, trade.executed.
Event-specific payload — see the individual webhook for its shape. Every order.*, trade.executed and wallet.* event carries orderId, clientOrderId (the key you supplied on POST /orders; null only for an order placed without one), marketId, eventId (the event the market belongs to) and externalCustomerId (your own id for the customer, as supplied when you registered them), so you can correlate on your own keys without a lookup. The exception is a wallet.credit with reason: market_settlement, which has no order behind it and carries marketId and positionId instead.
Response
Return any 2xx to acknowledge receipt. Anything else (including a timeout) is treated as a delivery failure and retried.