GET /obp/v7.0.0/management/banks/BANK_ID/dynamic-entity-web-hooks

The webhooks of every Dynamic Entity of a space, ordered by entity name.

A Dynamic Entity webhook makes OBP send a POST request to a URL when records of one Dynamic Entity are created, updated or deleted through the endpoints: the Dynamic Entity endpoints, Domain APIs, Dynamic Endpoints and Dynamic Resource Docs. Changes to the entity's definition, backups, restores and writes that do not go through the endpoints send nothing.

The request carries identifiers only (the event, the bank, the entity name and the record id), never the record's values: a receiver that needs the record fetches it with its own credentials, so the normal access checks apply when it reads. Delivery is at least once and in no particular order; each event carries an event_id to drop duplicates by.

BANK_ID is the space: a bank's id, or SYS for the system space. The Role is checked at that BANK_ID.

events names any of CREATED, UPDATED and DELETED. field_conditions narrows UPDATED: each condition names a field of the entity and, optionally, the value it must change from and the value it must change to, and an update fires the webhook when at least one condition matches. {"field": "amount"} matches any change to amount. Conditions do not apply to CREATED or DELETED.

url must be an absolute https URL. It may not point at this OBP instance, nor at a loopback, private, link-local or cloud metadata address. An entity has at most one webhook per URL.

Each request carries the headers OBP-Webhook-Id, OBP-Event-Id, OBP-Delivery-Attempt (1 on the first attempt) and OBP-Signature-Status. A 2xx reply counts as delivered. A 5xx, 408 or 429 reply, a timeout or a failed connection is retried with growing intervals, up to 144 attempts on this instance; any other reply, a redirect included, is not retried.

signature_status says whether deliveries from this instance are signed: on this instance it is not_configured. A signed delivery carries OBP-Signature, a JSON Web Signature over the exact request body with a detached payload (RFC 7515, Appendix F), made with the key published at GET /obp/v3.1.0/certs and named by its kid. An unsigned one has OBP-Signature-Status: not_configured.

deactivated_reason is present only while the webhook is not active: TURNED_OFF when someone set is_active false, CIRCUIT_BREAKER when it had 60 requests queued within a minute, and ENTITY_FIELD_REMOVED or ENTITY_FIELD_TYPE_CHANGED when the entity's definition changed under one of its field conditions.

For more information see here

User Authentication is Required. The User must be logged in. The Application must also be authenticated.

{ "web_hooks": [ { "webhook_id": "7d3c1c2e-5b7a-4f0e-9a51-2f1f6f0c9b11", "bank_id": "gh.29.uk", "dynamic_entity_id": "f6c2a8d4-1b3e-4c5f-8a7b-9d0e1f2a3b4c", "entity_name": "loan_application", "url": "https://receiver.example.com/hooks/obp", "events": [ "CREATED", "UPDATED", "DELETED" ], "field_conditions": [ { "field": "approved", "from": false, "to": true }, { "field": "amount" } ], "is_active": true, "description": "Tell the loan system when an application is approved or its amount changes", "signature_status": "signed", "created_by_user_id": "9ca9a7e4-6d02-40e3-a129-0b2bf89de9b1", "created_at": "2026-10-21T01:45:41Z", "updated_at": "2026-10-21T01:45:41Z" } ] }