Append .md to any page URL for its markdown source, or fetch llms-full.txt for the complete corpus.

Webhooks

application_offered

Sent when the customer receives a confirmed offer

Webhook eventapplication_offered

Header parameters

X-IW-Event-IDstringrequired

UUID of the webhook event. Webhooks which do not deliver successfully are retried. This will be the same across retry attempts for the same webhook.

X-IW-Event-Typestringrequired

The type of webhook being delivered — matches the webhook_event_type values from GET /webhooks/event_types/.

X-IW-Signaturestringrequired

HMAC-SHA256 signature of the request body, base64-encoded and prefixed with sha256=. The HMAC key is your webhook secret token (not your API token), which you can fetch from the iwoca Notifications API or the Developer Portal. Verify this header to confirm the webhook is genuinely from iwoca and to mitigate replay attacks (by also checking that X-IW-Timestamp is recent). Retried deliveries get a fresh timestamp and therefore a fresh signature.

message   = "{X-IW-Timestamp}.{raw_request_body}"
signature = "sha256=" + base64(hmac_sha256(secret, message))

X-IW-Timestampstringrequired

Unix timestamp (seconds) at which the delivery was initiated. If this delivery is a retry of an earlier failed delivery, the timestamp is of the current attempt, not the original delivery.

Payload

application_idstring<uuid>required

approximate_aprnumber<float>required

Approximate Annual Percentage Rate as a decimal. For example, 0.3995 means 39.95%. Note that this may differ to how this field is presented in the /offers endpoint, depending on which version you're using.

customer_idstring<uuid>required

amountnumberrequired

unitstringrequired

In practice, always days

Allowed values:daysmonthsyears

expiry_datestring<date>required

The date on which the offer expires

external_customer_idstring

The optional external_customer_id you sent in the POST /customers request when creating the customer

fee_percentagenumber<float>

What percentage of the amount borrowed will be added to the loan as a fee when the customer takes the money

>= 0<= 100

interest_only_repaymentsintegerrequired

Some offers have an interest-only period. For example if the payment_interval is 1m and interest_only_repayments is 3, the first three months of the loan are interest-only which means the first three repayments due will be lower than the normal repayments

Interest rate of the offer. Returned as a list but in practice there will be one item.

Array of object

as_ofintegerrequired

Unused

ratenumber<float>required

Interest rate as a decimal. For example, 0.028 means the interest rate is 2.8%. Note that this may differ to how this field is presented in the /offers endpoint, depending on which version you're using.

>= 0<= 1

is_closedbooleanrequired

Whether the application is closed. Usually, receiving a confirmed offer closes the application. Sometimes iwoca returns a confirmed offer for a smaller amount alongside an indicative offer for a larger amount, and the application remains open.

max_amountnumber<float>required

offer_idstring<uuid>required

payment_intervalstringrequired

How often repayments are due. (In practice, monthly).

personal_guarantee_proportionnumber<float>required

What percentage of the loan will be covered by a personal guarantee. For example, 100 for a normal loan or 0 for a loan with no PG required

>= 0<= 100

product_typestringrequired

iwoca product name

Allowed values:flexi_loanbusiness_loaniwocapaycbilsflexi24recovery_loanrevenue_based_loan

Unused

Array of string

revoked_atstring<date-time>required

If the offer has been revoked, shows the date and time at which it was revoked. Otherwise null.

Responses

Return status code 200 or 201 to acknowledge receipt of the webhook. Any non-2XX response code will result in iwoca retrying the delivery.