Skip to content
CryptonlyCryptonlyCryptonly

Webhook reference: invoice.statusChanged

POST
/webhooks/invoice.statusChanged

Reference schema for outbound webhooks Cryptonly POSTs to your configured HTTPS webhookUrl. Each delivery includes an x-webhook-signature header (HMAC-SHA256 over the raw JSON body). This route exists for Swagger documentation only; implement verification and handling on your own server.

Required scope: invoices.list.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
event
required
string
Allowed values: invoice.statusChanged
data
required
object
id
required
string
accountId
required
string format: uuid
orderId
string
amount
required
number
fiatCurrencyCode
required
string
items
required
Array<object>
object
name
required
string
quantity
required
number
cost
required
number
status
required
string
Allowed values: created processing paid partially_paid overpaid expired cancelled failed suspended
cryptoCurrencyCode
string
Allowed values: USDT_TRC20 USDT_ERC20 USDT_BEP20 USDC_ERC20 USDC_BEP20 USDC_BASE EURC_BASE LINK_ERC20 LINK_BEP20 ETH TRX BNB BTC ETH_BASE
cryptoAmountExpected
number
cryptoAmountReceived
number
address
string
txHash
string
settlement
object
amountPaid
required
number
amountPaidUsd
required
number
commissionAmount
required
number
commissionAmountUsd
required
number
networkFeeAmount
required
number
networkFeeAmountUsd
required
number
networkFeeCurrencyCode
required
string
netAmount
required
number
netAmountUsd
required
number
txHash
string
completedAt
required
string
description
string
number

Optional reference for the customer on the payment page, when set at creation.

string
<= 256 characters
webhookUrl
string
returnUrl

Browser CTA URL for cancelled / expired, when provided at creation.

string
successUrl

Browser CTA URL for paid / overpaid, when provided at creation.

string
failedUrl

Browser CTA URL for failed / suspended / partially_paid, when provided at creation.

string
expiresAt
required

ISO 8601 timestamp.

string
createdAt
required

ISO 8601 timestamp.

string
paidAt

When payment settled (ISO 8601), if applicable.

string
customerId

Merchant-supplied customer reference when provided at creation.

string
customPayload

Opaque string from creation; echoed on webhooks when set.

string
paymentPageUrl
required

Hosted payment page URL for this invoice.

string
source

Creation channel; omitted when unknown (rows created before this metadata existed).

string
Allowed values: api admin_panel
previousStatus

Status immediately before this transition.

string
Allowed values: created processing paid partially_paid overpaid expired cancelled failed suspended
timestamp
required

ISO 8601 timestamp when Cryptonly signed and sent the webhook.

string

Examples

Exampledefault

Sample invoice.statusChanged payload

{
  "event": "invoice.statusChanged",
  "data": {
    "id": "cdfcc58e-83c3-406b-82fe-f2e93a1a982e",
    "accountId": "7f4609bc-8239-451f-a0d9-7bed5ba57e7e",
    "orderId": "order_webhook_reference_001",
    "amount": 49.99,
    "fiatCurrencyCode": "USD",
    "items": [],
    "status": "paid",
    "cryptoCurrencyCode": "USDT_TRC20",
    "cryptoAmountExpected": 50,
    "cryptoAmountReceived": 50,
    "settlement": {
      "amountPaid": 50,
      "amountPaidUsd": 50,
      "commissionAmount": 0.5,
      "commissionAmountUsd": 0.5,
      "networkFeeAmount": 1,
      "networkFeeAmountUsd": 0.1,
      "networkFeeCurrencyCode": "TRX",
      "netAmount": 49.5,
      "netAmountUsd": 49.5,
      "completedAt": "2026-10-19T16:17:14.744Z"
    },
    "description": "Webhook reference example",
    "expiresAt": "2026-10-19T16:17:14.744Z",
    "createdAt": "2026-10-19T16:17:14.744Z",
    "source": "api",
    "paymentPageUrl": "https://payment.cryptonly.com/invoice/test-webhook-token",
    "paidAt": "2026-10-19T16:17:14.744Z"
  },
  "timestamp": "2026-01-01T12:00:00.000Z"
}

Responses

Section titled “Responses”

200

Section titled “200”

Reference endpoint acknowledged.

400

Section titled “400”

Request validation failed (e.g. missing or malformed body / query).

Media typeapplication/json
object
code
required

Stable machine-readable error code, namespaced under exceptions.. Always prefer branching on this value over message. See the per-route descriptions for the codes that route emits.

string
message
required

Human-readable explanation. Subject to wording changes; for programmatic checks use code instead.

string
extension

Optional structured payload accompanying the error. For exceptions.rateLimit.exceeded includes msBeforeNext; for validation errors includes the offending field info.

object
key
additional properties
any

Example 

{
  "code": "exceptions.auth.invalidApiKey",
  "message": "Invalid or missing API key"
}

401

Section titled “401”

Missing or invalid x-tenant-api-key header. Code: exceptions.auth.invalidApiKey.

Media typeapplication/json
object
code
required

Stable machine-readable error code, namespaced under exceptions.. Always prefer branching on this value over message. See the per-route descriptions for the codes that route emits.

string
message
required

Human-readable explanation. Subject to wording changes; for programmatic checks use code instead.

string
extension

Optional structured payload accompanying the error. For exceptions.rateLimit.exceeded includes msBeforeNext; for validation errors includes the offending field info.

object
key
additional properties
any

Example 

{
  "code": "exceptions.auth.invalidApiKey",
  "message": "Invalid or missing API key"
}

403

Section titled “403”

Request origin IP is not on the tenant API allowlist (exceptions.auth.ipNotAllowed), or the API key is missing the scope required by this operation (exceptions.auth.insufficientScope).

Media typeapplication/json
object
code
required

Stable machine-readable error code, namespaced under exceptions.. Always prefer branching on this value over message. See the per-route descriptions for the codes that route emits.

string
message
required

Human-readable explanation. Subject to wording changes; for programmatic checks use code instead.

string
extension

Optional structured payload accompanying the error. For exceptions.rateLimit.exceeded includes msBeforeNext; for validation errors includes the offending field info.

object
key
additional properties
any

Example 

{
  "code": "exceptions.auth.invalidApiKey",
  "message": "Invalid or missing API key"
}

429

Section titled “429”

Rate limit exceeded for this endpoint. Retry after the window resets. Code: exceptions.rateLimit.exceeded. The extension.msBeforeNext field tells you how long to wait.

Media typeapplication/json
object
code
required

Stable machine-readable error code, namespaced under exceptions.. Always prefer branching on this value over message. See the per-route descriptions for the codes that route emits.

string
message
required

Human-readable explanation. Subject to wording changes; for programmatic checks use code instead.

string
extension

Optional structured payload accompanying the error. For exceptions.rateLimit.exceeded includes msBeforeNext; for validation errors includes the offending field info.

object
key
additional properties
any

Example 

{
  "code": "exceptions.auth.invalidApiKey",
  "message": "Invalid or missing API key"
}

500

Section titled “500”

Unexpected server error. Safe to retry idempotent operations after a backoff.

Media typeapplication/json
object
code
required

Stable machine-readable error code, namespaced under exceptions.. Always prefer branching on this value over message. See the per-route descriptions for the codes that route emits.

string
message
required

Human-readable explanation. Subject to wording changes; for programmatic checks use code instead.

string
extension

Optional structured payload accompanying the error. For exceptions.rateLimit.exceeded includes msBeforeNext; for validation errors includes the offending field info.

object
key
additional properties
any

Example 

{
  "code": "exceptions.auth.invalidApiKey",
  "message": "Invalid or missing API key"
}