Webhook Reference

transaction.created

Fired when a new transaction (buy, sell, dividend or transfer) is recorded in your portfolio. Transactions created by a statement import are not sent individually. They are covered by import.completed instead, so a single upload cannot flood your endpoint with hundreds of deliveries.

{
  "event": "transaction.created",
  "timestamp": "2026-04-03T10:15:00.123456+00:00",
  "data": {
    "id": "6f1c0a2e-5d4b-4a91-9f7c-2b8e3d4a5c60",
    "type": "buy",
    "symbol": "AAPL",
    "quantity": "10.0000000000",
    "price_per_unit": "185.5000000000",
    "currency": "USD",
    "transaction_date": "2026-04-03",
    "account_id": "1d9b6c44-0f2a-4e7b-8c31-77a5e9d0b412"
  }
}

corporate_action.detected

Fired when a stock split, dividend distribution or merger has been applied to holdings you actually hold. The counters report what it changed.

{
  "event": "corporate_action.detected",
  "timestamp": "2026-04-03T14:30:00.123456+00:00",
  "data": {
    "id": "9c2f7b18-3e5a-4d62-b0f4-6a1c8e2d9f37",
    "action_type": "split",
    "symbol": "NVDA",
    "ex_date": "2026-06-10",
    "lots_modified": 3,
    "transactions_created": 1
  }
}

price_alert.triggered

Fired when a watchlist price alert condition is met, for example when a security’s price crosses a threshold you set. The direction field tells you which way the threshold was breached.

{
  "event": "price_alert.triggered",
  "timestamp": "2026-04-03T09:45:00.123456+00:00",
  "data": {
    "id": "4b7d1e90-8c26-4f53-a1d8-95e0c3b7a642",
    "watchlist_id": "2a6e5f31-7b40-49c8-8d17-0e4b9a3c5d28",
    "symbol": "TSLA",
    "direction": "above",
    "threshold": "250.0000000000",
    "current_price": "251.3000000000",
    "currency": "USD"
  }
}

tax.recalculated

Fired when a tax year is recalculated for you, such as after a new transaction or corporate action adjusts your cost basis. One delivery is sent per tax year recalculated.

{
  "event": "tax.recalculated",
  "timestamp": "2026-04-03T11:00:00.123456+00:00",
  "data": {
    "id": "8e3a5c72-1f94-4b06-9d28-c7b1f0e6a534",
    "jurisdiction": "GBR",
    "tax_year": 2026,
    "calculation_method": "section_104",
    "net_taxable_gains": "1234.5600000000",
    "currency": "GBP",
    "calculated_at": "2026-04-03T10:59:58.654321+00:00"
  }
}

import.completed

Fired when a brokerage statement import reaches a terminal state, whether it succeeded (including with partial errors) or failed. Read the status field to tell the two apart.

{
  "event": "import.completed",
  "timestamp": "2026-04-03T12:20:00.123456+00:00",
  "data": {
    "id": "0c58d3a6-9e21-4f7b-8a40-b6d2e1c9f503",
    "broker_name": "Interactive Brokers",
    "status": "completed",
    "rows_parsed": 50,
    "transactions_created": 47,
    "transactions_skipped": 2,
    "transactions_failed": 1
  }
}

Python example

import hmac
import hashlib

def verify_signature(payload_body, secret, signature_header):
    expected = hmac.new(
        secret.encode("utf-8"),
        payload_body,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature_header)

JavaScript example

const crypto = require("crypto");

function verifySignature(payloadBody, secret, signatureHeader) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payloadBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

Standard Webhooks verification

Deliveries also follow the Standard Webhooks specification, so an off-the-shelf Standard Webhooks library can verify them. That signature covers the timestamp too, so you can reject old or replayed deliveries. Sign {webhook-id}.{webhook-timestamp}.{raw body} with HMAC-SHA256, using your endpoint secret’s UTF-8 bytes as the key, and compare the base64 result with the value after v1, in webhook-signature. A Standard Webhooks library expects the key base64-encoded, so pass it the base64 encoding of your endpoint secret.

import base64
import hmac
import hashlib

def verify_standard_webhook(payload_body, secret, headers):
    signed = (
        f"{headers['webhook-id']}.{headers['webhook-timestamp']}.".encode()
        + payload_body
    )
    expected = base64.b64encode(
        hmac.new(secret.encode("utf-8"), signed, hashlib.sha256).digest()
    ).decode()
    return any(
        hmac.compare_digest(f"v1,{expected}", candidate)
        for candidate in headers["webhook-signature"].split(" ")
    )

Automatic deactivation

After 10 consecutive failed deliveries, the endpoint is automatically deactivated and you will receive an email notification. Reactivating a deactivated endpoint is not currently possible from the Developer page. You need to delete it and register it again, which issues a new signing secret.