Registers a URL to receive webhook events, such as payment, subscription, payout, and dispute updates. Pick the events in enabled_events; the table on that field lists every event and its payload.

Before saving, Mamo sends a test POST with the body {"ping":"pong"} to your url (with your auth_header, if you set one). Your endpoint must answer with a 2xx status. Otherwise the call fails with 422 and Webhook is unreachable.

🚧

Calling this again with an existing URL

If a webhook with the same url already exists, this call updates it instead of creating a new one: the enabled_events you send are added to its current events, and its auth_header is replaced with the one you send (or cleared if you leave it out). No new signing_secret is returned. To replace the event list instead, use Update webhook.

[Optional] HMAC verification

When this call creates a new webhook, the response includes a signing_secret. Mamo uses it to sign every delivery with an HMAC-SHA256 Mamo-Signature header.

❗

The signing secret is returned only once

It isn't included in the List webhooks or Update webhook responses, or when you call this endpoint again with the URL of an existing webhook. Store it securely. If you lose it, delete the webhook and create it again.

See Webhook delivery for how to verify the signature.

[Optional] Verify Mamo source IP

Every webhook delivery comes from one of these fixed IP addresses. Allowlist them on your firewall or check the request's source IP in your handler, then reject anything else.

Use this alongside the Mamo-Signature and auth_header checks, not instead of them. If your server sits behind a load balancer or proxy, check the original client IP it forwards (for example in X-Forwarded-For), not the proxy's own address.