Webhook Events and Signatures

To verify the signature of a webhook event sent to you from UTB's servers, we follow similar steps to generating signatures for requests to the UTB API.

UTB Public Key

Send an email to developmentteam@utb.comto request a copy of UTB's ECDSA secp256k1 public key.

Verification

If using a cryptography library that has a verify signature method:

  1. Concatenate the webhook request body, Date header value, and X-UTB-Signature-Nonce header value.

  2. Provide the value in step 1 to the library method as the input, the UTB ECDSA secp256k1 public key as the key, and the signature in the X-UTB-Signature header as the signature.

If verifying manually:

  1. Decrypt the request signature in the X-UTB-Signature header with the UTB ECDSA secp256k1 public key.

  2. Concatenate the webhook request body, Date header value, and X-UTB-Signature-Nonce header value.

  3. Hash the value from step 2 with HMAC256

  4. Compare the hashed value from step 3 and the decrypted header in step 1. If they match, the request is verified.

new_transaction Webhook Payload

This payload is returned for webhook registrations of type new_transaction. It is designed to follow a very similar schema to the TODO link account history endpoint to minimize extra development.

Example

JSON

{
"webhook_registration_account_number": "1234567",
"amount": 100,
"timestamp": true,
"transaction_id": "JX5T452HI0",
"tran_code": "144",
"tran_code_description": "Transfer to DDA",
"debit_credit_flag": "Debit",
"description_line1": "UTB Global|1234567|7654321|",
"description_line2": "Payment for service|c628ce5b-cc34-42ae-959f-3f2f14971f97",
"debit_account_number": "1234567",
"credit_account_number": "7654321",
"counter_party_name": "UTB Global",
"memo": "Payment for service",
"references": {
"payment_id": "c628ce5b-cc34-42ae-959f-3f2f14971f97"
}
}

OpenAPI Schema

JSON

{
"transaction_webhook_payload": {
"type": "object",
"properties": {
"webhook_registration_account_number": {
"type": "string",
"description": "Account associate with the webhook registration.",
"nullable": true,
"example": "1234567"
},
"amount": {
"type": "number",
"description": "The amount of the transaction.",
"format": "double",
"example": 100
},
"timestamp": {
"type": "string",
"description": "Date the transaction was submitted to the system. When the data source is \"cache\", this will include a time component expressed in the UTC time zone. When the data source is \"core\", this will have a zeroed time component for memo posted transactions and will be null for hard posted transactions.",
"format": "date-time",
"nullable": true,
"example": "2023-06-06T12:29:20"
},
"transaction_id": {
"type": "string",
"description": "Transaction Id.",
"nullable": true,
"example": "JX5T452HI0"
},
"tran_code": {
"type": "string",
"description": "Transaction code.",
"nullable": true,
"example": "144"
},
"tran_code_description": {
"type": "string",
"description": "Transaction code description.",
"nullable": true,
"example": "Transfer to DDA"
},
"debit_credit_flag": {
"type": "string",
"description": "Direction of the transaction. Expected values: Debit or Credit",
"nullable": true,
"example": "Debit"
},
"description_line1": {
"type": "string",
"description": "Description Line 1 of the transaction.",
"nullable": true,
"example": "UTB Global|1234567|7654321|"
},
"description_line2": {
"type": "string",
"description": "Description Line 2 of the transaction.",
"nullable": true,
"example": "Payment for service|c628ce5b-cc34-42ae-959f-3f2f14971f97"
},
"debit_account_number": {
"type": "string",
"description": "The account this transaction was debited from. This field may be null if the transaction depending on transaction type/direction.",
"nullable": true,
"example": "1234567"
},
"credit_account_number": {
"type": "string",
"description": "The account this transaction was credited to. This field may be null if the transaction depending on transaction type/direction.",
"nullable": true,
"example": "7654321"
},
"counter_party_name": {
"type": "string",
"description": "The name of the counter party. This field may be null if the transaction depending on transaction type. Applicable transaction types: internal_transfer, wire",
"nullable": true,
"example": "UTB Global"
},
"memo": {
"type": "string",
"description": "Memo line from the transaction. This field may be null if the transaction depending on transaction type. Applicable transaction types: internal_transfer",
"nullable": true,
"example": "Payment for service"
},
"references": {
"type": "object",
"additionalProperties": {
"type": "string"
},
"description": "Dictionary of reference IDs for the transaction. Expected IDs included by transaction type: internal_transfer: payment_id wire: payment_id, wire_system_reference_id, sender_reference (debit only)",
"nullable": true,
"example": {
"payment_id": "c628ce5b-cc34-42ae-959f-3f2f14971f97"
}
}
},
"additionalProperties": false
}
}