Lunch
Lunch Partner API

Subscribe to events instead of polling for them.


List your subscriptions

GET
https://api.luxor.lunchpayments.com
/v1/webhooks

Live subscriptions only. Secrets are never returned.

List your subscriptions Responses

Your live subscriptions

object[] · required

Subscribe to events

POST
https://api.luxor.lunchpayments.com
/v1/webhooks

Registers a destination we will POST events to. Every delivery carries Lunch-Signature: t=<unix seconds>,v1=<hex>, where the signature is HMAC-SHA256 over the exact string "<timestamp>.<raw body>" using the secret returned when you created the subscription. Compare it in constant time, and reject a timestamp older than 5 minutes. Without that the signature says only that the body was ours once, not that this delivery is fresh. Delivery is at-least-once: a retry can arrive after a success we failed to record. Lunch-Delivery is stable across attempts, so treat it as the key. Ordering is not guaranteed, and out-of-order arrivals do not resolve themselves. A delivery that failed and is retried can land after a later one succeeded, so a financing update can arrive behind the state that replaced it. partner.invoice.factoredUpdated therefore carries a sequence: ignore one whose sequence is not greater than the one you hold for that invoice. Every delivery also carries occurredAt, which is useful for logs and is NOT an ordering key. it is the transaction start time, so two events can carry stamps in the opposite order to their causes. Answer 2xx to accept. Anything else is retried over about 28 hours; answer 410 when the endpoint is gone for good and we will stop and revoke the subscription.

Subscribe to events Request Body

url
string · uri · required

An https endpoint on the public internet. We refuse anything that resolves to a private, loopback or link-local address, and we do not follow redirects.

eventTypes
string[] · maxItems: 9

Which events to send. Leave it empty for all of them, including any we add later, which is what most integrations want.

Enum values:
partner.organization.added
partner.invoice.created
partner.invoice.paid
partner.invoice.factoredUpdated
partner.loan.created
partner.loan.issued
partner.loan.paid
partner.organization.remittanceUpdated

Subscribe to events Responses

Subscribed. The secret is shown HERE and never again.

reference
string · required

What to call this subscription.

url
string · required
eventTypes
string[] · maxItems: 9 · required

Which events to send. Leave it empty for all of them, including any we add later, which is what most integrations want.

Enum values:
partner.organization.added
partner.invoice.created
partner.invoice.paid
partner.invoice.factoredUpdated
partner.loan.created
partner.loan.issued
partner.loan.paid
partner.organization.remittanceUpdated
createdAt
string · date-time · required
secret
string · required

Store it now, because no other call returns it. To rotate, revoke this subscription and create another.


Stop sending to a destination

DELETE
https://api.luxor.lunchpayments.com
/v1/webhooks/{reference}

Stop sending to a destinationpath Parameters

reference
string · minLength: 1 · required

Stop sending to a destination Responses

Revoked. Nothing further is delivered, including anything already queued.

revoked
boolean · enum · required
Enum values: