> For the complete documentation index, see [llms.txt](/llms.txt).

# indicative_offer_created

**Webhook event:** `indicative_offer_created`

Sent when an indicative offer is created

## Header parameters
- `X-IW-Event-ID` (string, required) — UUID of the webhook event. Webhooks which do not deliver successfully are retried. This will be the same across retry attempts for the same webhook.
- `X-IW-Event-Type` (string, required) — The type of webhook being delivered — matches the `webhook_event_type` values from `GET /webhooks/event_types/`.
- `X-IW-Signature` (string, required) — HMAC-SHA256 signature of the request body, base64-encoded and prefixed with `sha256=`. The HMAC key is your webhook secret token (not your API token), which you can fetch from the iwoca Notifications API or the Developer Portal. Verify this header to confirm the webhook is genuinely from iwoca and to mitigate replay attacks (by also checking that `X-IW-Timestamp` is recent). Retried deliveries get a fresh timestamp and therefore a fresh signature.

```
message   = "{X-IW-Timestamp}.{raw_request_body}"
signature = "sha256=" + base64(hmac_sha256(secret, message))
```
- `X-IW-Timestamp` (string, required) — Unix timestamp (seconds) at which the delivery was initiated. If this delivery is a retry of an earlier failed delivery, the timestamp is of the current attempt, not the original delivery.

## Payload
```json
{
  "data": {
    "application_id": "2e1637d0-2403-4f57-b3fa-cb04f650683d",
    "customer_id": "b493d64d-c785-471e-9972-bed4fc91b359",
    "data_requirements": [
      {
        "actions": [
          {
            "name": "upload_bank_statement",
            "quantifier": {
              "unit": "months",
              "value": 6
            }
          }
        ],
        "category": "documents"
      }
    ],
    "duration": {
      "amount": 365,
      "unit": "days"
    },
    "external_customer_id": "12345",
    "interest_rate": 0.0265,
    "is_suggested": true,
    "max_amount": 50000,
    "offer_id": "3394ca6a-30e7-4e74-8b94-3c93fa1dcd85",
    "probability_of_offer": "medium_probability_of_offer",
    "product_type": "flexi_loan",
    "timeout": "2026-06-25T00:00:00+0000"
  }
}
```

### Payload fields
- `data` (object, required)
- `data.application_id` (string, required)
- `data.customer_id` (string, required)
- `data.data_requirements` (array) — Use this field to determine next steps for your customer if the offer is not of type 'confirmed'.
- `data.data_requirements[].actions` (array)
- `data.data_requirements[].actions[].name` (string, required)
- `data.data_requirements[].actions[].quantifier` (object) — If an action is of category 'documents', it will have a 'quantifier' field specifying a number of documents or a number of months or years.
- `data.data_requirements[].actions[].quantifier.unit` (string) — If the value represents a number of months or years, this field will specify what the unit is.
- `data.data_requirements[].actions[].quantifier.value` (number, required)
- `data.data_requirements[].category` (string)
- `data.duration` (object, required)
- `data.duration.amount` (number, required)
- `data.duration.unit` (string, required) — In practice, always days
- `data.external_customer_id` (string) — The optional external_customer_id you sent in the POST /customers request when creating the customer
- `data.interest_rate` (number) — Interest rate as a decimal. For example, 0.028 means the interest rate is 2.8%. Note that this may differ to how this field is presented in the /offers endpoint, depending on which version you're using.
- `data.is_suggested` (boolean, required) — Whether in iwoca's opinion this offer is the one which best matches the parameters requested in the application
- `data.max_amount` (number, required)
- `data.offer_id` (string, required)
- `data.probability_of_offer` (string)
- `data.product_type` (string, required)
- `data.timeout` (string, required) — Expiry datetime of the indicative offer

## Responses
### 201 — Return status code 200 or 201 to acknowledge receipt of the webhook. Any non-2XX response code will result in iwoca retrying the delivery.