Account

Meridian signs every webhook it sends you.

Headers on every delivery:

• X-Meridian-Api-Key
• X-Meridian-Timestamp
• X-Meridian-Signature

X-Meridian-Signature is the lowercase hex HMAC-SHA256 of apiKey + timestamp + "POST" + path + body, keyed with your webhook secret. The path is the path of your webhook URL, without any query string. The body is the raw request body, byte for byte. Recompute the signature and reject the request if it does not match. See Security.

The resource this event is about. Always account for this webhook.

Which event fired. account_created when the account is created, account_status_updated after it changes.

Your webhook API key. Meridian issues it separately from your REST API credentials, and uses one key for every webhook event. Use it to choose the webhook secret to verify with. The key on its own does not prove the request came from Meridian; the signature does.

When Meridian signed this delivery attempt, in milliseconds since the Unix epoch. Every retry is signed again, so each attempt has a new timestamp. Reject requests whose timestamp is far from your own clock.