Webhooks

Webhooks overview

How to receive real-time events from iwoca, and the endpoints that manage them

Webhooks let iwoca notify your system the moment something happens — an application is offered or declined, or a customer is funded. You never have to poll. There are two sides to webhooks in this API:

Endpoints you call to configure your webhook URL and manage which events you receive.
Events iwoca sends to your endpoint as POST requests when something happens.

How webhooks work (guide)

Concepts, base URL and end-to-end setup

Security

Verify the X-IW-Signature header and handle retries

Setting up

1
Configure your webhook URL and token
Set the endpoint iwoca should call using PUT /webhooks/configuration/. Read the current config with GET /webhooks/configuration/.
2
Subscribe to the events you want
Choose which events to receive with POST /webhooks/subscriptions/. Review your subscriptions with GET /webhooks/subscriptions/, and remove them with DELETE /webhooks/subscriptions/.
3
Check available event types
See every event you can subscribe to with GET /webhooks/event_types/.
4
Verify signatures
Confirm each incoming webhook is from iwoca by checking the X-IW-Signature header — see Security.

Your webhook endpoint should respond with a 2xx status code to confirm receipt. Failed deliveries are retried up to 10 times over roughly 16 hours – see retry behaviour. Your subscription stays active either way; it is never disabled automatically.

Events iwoca sends

Each event below is delivered as a POST to your configured URL. Follow the link for the exact payload schema. The list reflects the webhooks published in the version and locale you're currently viewing.

Event	When it fires
`application_attributed`	Sent when an application is created for a customer and attributed to you.
`application_declined`	Sent when a customer's application is declined
`application_deferred`	Sent when a customer's application is deferred (closed without reaching an approval or decline decision)
`application_offered`	Sent when the customer receives a confirmed offer.
`application_status_changed`	Sent when the status of an application changes
`customer_funded`	Sent when a customer draws down funds from an offer which originated from an application you introduced.
`funding_created_202607`	Sent when funds are sent to a customer. If the funding originated from an application, `application_id` is populated.
`indicative_offer_created`	Sent when an indicative offer is created
`prequalification_202505`	Sent when a file uploaded to the POST /prequalification_data endpoint has been processed.
`prequalification_data_file_processed_202510`	Sent when a file that was uploaded to the POST /prequalification_data endpoint has finished processing