{
"id": "<string>",
"type": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"data": {
"payment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"kind": "<string>",
"status": "<string>",
"amount_minor": "<string>",
"currency": "<string>",
"payment_link_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}payment.completed
Sent when a PIX payin/payout, crypto send, or RFQ settlement reaches status completed. Signed with HMAC-SHA256: the endpoint’s secret signs the string ${x-clarian-timestamp}.${raw request body}; the hex digest is sent as x-clarian-signature. Verify by recomputing the HMAC over the exact bytes received and comparing with a constant-time check. x-clarian-timestamp is the send time of this attempt (ISO-8601), so a retry carries a fresh one; the body’s created_at stays the event time; x-clarian-event repeats the event type. The JSON body is {id, type, created_at, data}, where data is the payload below. Delivery retries on a non-2xx response.
{
"id": "<string>",
"type": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"data": {
"payment_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"kind": "<string>",
"status": "<string>",
"amount_minor": "<string>",
"currency": "<string>",
"payment_link_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}Authorizations
Authorization: Bearer cl_test_sk_... (sandbox) or Bearer cl_live_sk_... (live). A live key additionally needs production enabled by the workspace owner. Using a live key against the sandbox path revokes it on sight (leak signal); a sandbox key on live is refused and logged, but not revoked.
The workspace (tenant) UUID. Always required, including on session-authenticated dashboard calls.
Body
Response
Any 2xx response marks the delivery as delivered.