Event types
Your business has two webhook URLs:collection_url and payout_url. The table below shows every event and which URL it is delivered to.
| Event | Description | Delivered to | Guide |
|---|---|---|---|
collection.initiated | Collection request created | collection_url | Collection |
collection.pending | Awaiting customer payment | collection_url | Collection |
collection.completed | Payment received successfully | collection_url | Collection |
collection.failed | Payment failed | collection_url | Collection |
payout.initiated | Payout has been created | payout_url | Payout |
payout.processing | Payout is being processed | payout_url | Payout |
payout.completed | Payout completed successfully | payout_url | Payout |
payout.failed | Payout failed | payout_url | Payout |
customer.created | New customer created | collection_url | Customer |
customer.verified | Customer KYC verified | collection_url | Customer |
customer.rejected | Customer KYC rejected | collection_url | Customer |
virtual_account.created | Virtual account created | collection_url | Virtual account |
virtual_account.ready | Virtual account ready to receive funds | collection_url | Virtual account |
virtual_account.rejected | Virtual account verification rejected | collection_url | Virtual account |
virtual_account.failed | Virtual account creation failed | collection_url | Virtual account |
virtual_account.credited | Funds received in virtual account | collection_url | Virtual account |
All events except payout events are delivered to your
collection_url. Register both URLs via the Webhook API.Payload structure
All webhook payloads include:event— The event typedata— The event data objecttimestamp— When the event occurredsignature— HMAC signature for verification (header:x-blaaiz-signature)
Always verify thex-blaaiz-signatureusing your webhooksigning_secretto ensure the webhook originates from Blaaiz.
Webhook retries
We retry deliveries with exponential backoff and jitter to avoid thundering herds.- Attempts: up to 10 total
- Initial backoff: 5 minutes
- Backoff factor: 2x per attempt
- Max backoff cap: 24 hours (1440 minutes)
- Jitter: 80–120% randomization on each delay
- Success: any HTTP 2xx response stops retries
- Any non-2xx (4xx/5xx/timeout/connection error) triggers the next retry
| Attempt | Approx. delay | Cumulative time |
|---|---|---|
| 1 | Immediate | 0 |
| 2 | ~5 minutes | ~5 min |
| 3 | ~10 minutes | ~15 min |
| 4 | ~20 minutes | ~35 min |
| 5 | ~40 minutes | ~1.25 hours |
| 6 | ~80 minutes | ~2.5 hours |
| 7 | ~160 minutes | ~5 hours |
| 8 | ~320 minutes | ~10 hours |
| 9 | ~640 minutes | ~21 hours |
| 10 | ~1280 minutes | ~42 hours |
⚙️ Best practices
- Reply with a 2xx quickly (within 30 seconds) and process work asynchronously if needed.
- Implement idempotency using the
event_idso duplicate deliveries don’t double-process work.- Return non-2xx only when you truly want a retry.
Data retention
Webhook logs (payloads, responses, attempt history) are retained for 90 days. After 90 days, records are pruned for both successful and failed deliveries.- If you need webhook data beyond 90 days, store it in your own systems.
- Replay is only available for webhooks within the 90-day window.

