Withdrawal updated

We send this to your URL, once we’ve set a webhook up for your key: contact us with its name and your URL, and we give you a signing secret once. Setup, checking the signature and retries: Webhooks. A USDC withdrawal on your account changed status. Every webhook on the account whose key holds withdraw:funds as well as read:account gets it.

At most one event per status: processing, pending_review, then completed or failed, which are final. Two quick changes can collapse into one, so a fast withdrawal may send only completed, and delivery is unordered. Get a withdrawal always has the current status.

WEBHOOK withdrawal.updated

Example

{
  "id": "evt_5e2c8a14d97b3f60a1c4e8d2b7f09a35",
  "type": "withdrawal.updated",
  "created_at": "2026-11-03T18:02:10.000Z",
  "data": {
    "withdrawal": {
      "id": "3a6f1c2e-…",
      "status": "completed",
      "amount": 2500,
      "fee": 0,
      "currency": "USDC",
      "destination": {
        "network": "USDC on Base",
        "address": "0xab12…ab12"
      },
      "tx_hashes": [
        "0x9c41…"
      ],
      "failure_reason": null,
      "created_at": "2026-11-03T18:00:00.000Z",
      "completed_at": "2026-11-03T18:02:10.000Z"
    }
  }
}

Headers

X-CatchBack-Signature · string · required

t=<unix seconds>,v1=<hex>. v1 is the HMAC-SHA256 of <t>.<raw request body>, keyed with your whole secret, whsec_ included. Compute it over the raw bytes before any JSON parsing, compare in constant time, and refuse a t more than 5 minutes from your clock.

X-CatchBack-Event · string · required

The event's type.

X-CatchBack-Event-Id · string · required

The event's id, which stays the same on every retry.

X-CatchBack-Attempt · integer · required

Which try this is, from 1 to 8.

Required range: 1 <= x <= 8

Body

application/json

id · string · required

The event's id, evt_ and 32 hex characters. It never changes, including across retries, so dedupe on it.

type · string · required

More event types will be added without notice, so ignore a type you don't recognize.

Allowed value: "withdrawal.updated"

created_at · string<date-time> · required

When the thing happened, not when we sent the event.

data · object · required

Show child attributes

Response

200

Answer any 2xx within 5 seconds, and do slow work after you've answered. Anything else counts as a failure, including a redirect. We retry after 1 minute, 5 minutes, 30 minutes, 2, 6, 12 and 24 hours, then stop at 8 attempts. Delivery is at-least-once and unordered, so dedupe on id.