Configure webhook URLs from the business dashboard. These URLs are used for Rivo Business event delivery once outbound webhook dispatch is enabled for your integration.

​
Current rollout note

Webhook URL management is available today. Before relying on live partner webhook events, confirm with Rivo that outbound delivery has been enabled for the event types you need.

​
Manage webhook URLs

Webhook management uses the business dashboard JWT flow, not API-key signing.

​
Create webhook

POST /business/v1/webhooks
Authorization: Bearer BUSINESS_DASHBOARD_JWT
Content-Type: application/json

{
  "targetUrl": "https://merchant.example.com/rivo/webhooks"
}
targetUrl must be a valid http or https URL. Duplicate URLs for the same business are rejected. Example response: 
{
  "status": "success",
  "message": "Webhook added successfully",
  "data": {
    "_id": "6a51a0000000000000000001",
    "businessId": "69f13c6445e423d22696ad09",
    "targetUrl": "https://merchant.example.com/rivo/webhooks",
    "secret": "whsec_example",
    "createdAt": "2026-07-11T01:40:00.000Z",
    "updatedAt": "2026-07-11T01:40:00.000Z"
  }
}

​
List webhooks

GET /business/v1/webhooks
Authorization: Bearer BUSINESS_DASHBOARD_JWT
Example response: 
{
  "status": "success",
  "message": "Webhooks retrieved successfully",
  "data": [
    {
      "_id": "6a51a0000000000000000001",
      "businessId": "69f13c6445e423d22696ad09",
      "targetUrl": "https://merchant.example.com/rivo/webhooks",
      "secret": "whsec_example",
      "createdAt": "2026-07-11T01:40:00.000Z",
      "updatedAt": "2026-07-11T01:40:00.000Z"
    }
  ]
}

​
Delete webhook

DELETE /business/v1/webhooks/{id}
Authorization: Bearer BUSINESS_DASHBOARD_JWT
Example response: 
{
  "status": "success",
  "message": "Webhook deleted successfully",
  "data": {}
}

payment.created
payment.completed
payment.failed
payment_link.created
payment_link.paid
payment_link.expired
transfer.created
transfer.completed
transfer.failed

​
Security

Keep webhook secrets on your backend only. Verify webhook signatures before trusting a payload, and return a 2xx response only after your server accepts the event. To rotate a webhook secret today, delete the webhook URL and create it again. Store the new secret on your backend before enabling event handling for that URL.

​
Supported IP allowlist

Supported IPs are configured from the business dashboard and apply to signed Rivo Business API-key requests. If no supported IPs are configured, signed API-key requests are accepted from any IP address after normal authentication and signature checks pass. Once at least one supported IP is configured, Rivo only accepts signed API-key requests from the configured IP addresses.

​
Add supported IP

POST /business/v1/supported-ips
Authorization: Bearer BUSINESS_DASHBOARD_JWT
Content-Type: application/json

{
  "ipAddress": "203.0.113.10"
}
ipAddress must be a valid IPv4 or IPv6 address. Each business can configure up to 5 supported IP addresses. Example response: 
{
  "status": "success",
  "message": "Supported IP added successfully",
  "data": {
    "_id": "6a51a0000000000000000002",
    "businessId": "69f13c6445e423d22696ad09",
    "ipAddress": "203.0.113.10",
    "createdAt": "2026-07-11T01:45:00.000Z",
    "updatedAt": "2026-07-11T01:45:00.000Z"
  }
}

​
List supported IPs

GET /business/v1/supported-ips
Authorization: Bearer BUSINESS_DASHBOARD_JWT
Example response: 
{
  "status": "success",
  "message": "Supported IPs retrieved successfully",
  "data": [
    {
      "_id": "6a51a0000000000000000002",
      "businessId": "69f13c6445e423d22696ad09",
      "ipAddress": "203.0.113.10",
      "createdAt": "2026-07-11T01:45:00.000Z",
      "updatedAt": "2026-07-11T01:45:00.000Z"
    }
  ]
}

​
Delete supported IP

DELETE /business/v1/supported-ips/{id}
Authorization: Bearer BUSINESS_DASHBOARD_JWT
Example response: 
{
  "status": "success",
  "message": "Supported IP deleted successfully",
  "data": {}
}
If a signed API-key request comes from an IP address outside the configured allowlist, Rivo returns: 
{
  "status": "error",
  "message": "IP address is not allowed",
  "data": {}
}