External account webhook

Webhook that is called whenever the status or the account details of an external account change. Status changes cover any transition between statuses (PENDING, ACTIVE, UNDER_REVIEW, INACTIVE, PENDING_OWNERSHIP_VERIFICATION, UNVERIFIED) — for example when an account under review becomes active, when ownership verification completes (PENDING_OWNERSHIP_VERIFICATION → ACTIVE), or when a verification attempt fails (PENDING_OWNERSHIP_VERIFICATION → UNVERIFIED). This endpoint should be implemented by clients of the Grid API.

Authentication

The webhook includes a signature in the X-Grid-Signature header that allows you to verify that the webhook was sent by Grid. To verify the signature:

1. Get the Grid public key provided to you during integration
2. Decode the base64 signature from the header
3. Create a SHA-256 hash of the request body
4. Verify the signature using the public key and the hash

If the signature verification succeeds, the webhook is authentic. If not, it should be rejected.

Event types

• EXTERNAL_ACCOUNT.STATUS_UPDATED — Fired when the status of an external account changes. The data payload contains the full external account object.
• EXTERNAL_ACCOUNT.ACCOUNT_INFO_UPDATED — Fired when Grid corrects an external account’s accountInfo. Today this happens when the receiving bank sends an ACH notification of change (NOC) with corrected details, such as a new routing number, account number or bank account type. The account keeps its id, and later payments to it use the corrected details. The data payload contains the full external account object with the corrected accountInfo. Deliveries can arrive out of order, and the external account has no version field, so an older STATUS_UPDATED payload can carry the pre-correction details. Before you replace a stored copy of the account details, fetch the current account with GET /customers/external-accounts/{externalAccountId} (or the platform equivalent) and store that response.

WEBHOOK external-account-status

JSON

verificationSucceeded

{
  "id": "Webhook:019542f5-b3e7-1d02-0000-000000000042",
  "type": "EXTERNAL_ACCOUNT.STATUS_UPDATED",
  "timestamp": "2025-08-15T14:32:00Z",
  "data": {
    "id": "ExternalAccount:e85dcbd6-dced-4ec4-b756-3c3a9ea3d965",
    "customerId": "Customer:da459a29-1fb7-41ce-a4cb-eb3a3c9fd7a7",
    "status": "ACTIVE",
    "currency": "USDC",
    "ownershipType": "FIRST_PARTY",
    "accountInfo": {
      "accountType": "ETHEREUM_WALLET",
      "address": "0xAbCDEF1234567890aBCdEf1234567890ABcDef12"
    }
  }
}

400

{
  "code": "INVALID_INPUT",
  "reason": "<string>",
  "details": {
    "errors": [
      {
        "field": "identifier",
        "constraint": {
          "format": "email",
          "pattern": "^\\d{5}(-\\d{4})?$",
          "enum": [
            "SSN",
            "ITIN",
            "NON_US_TAX_ID"
          ],
          "minLength": 1,
          "maxLength": 500
        },
        "message": "Value is not one of the allowed enum members."
      }
    ]
  }
}

Authorizations

X-Grid-Signature · string · header · required

Secp256r1 (P-256) asymmetric signature of the webhook payload, which can be used to verify that the webhook was sent by Grid. To verify the signature:

1. Get the Grid public key provided to you during integration
2. Decode the base64 signature from the header
3. Create a SHA-256 hash of the request body
4. Verify the signature using the public key and the hash

If the signature verification succeeds, the webhook is authentic. If not, it should be rejected.

Body

application/json

id · string · required

Unique identifier for this webhook delivery (can be used for idempotency)

Example:

"Webhook:019542f5-b3e7-1d02-0000-000000000007"

type · enum<string> · required

Status-specific event type in OBJECT.EVENT dot-notation (e.g., OUTGOING_PAYMENT.COMPLETED)

Available options: EXTERNAL_ACCOUNT.STATUS_UPDATED, EXTERNAL_ACCOUNT.ACCOUNT_INFO_UPDATED

timestamp · string<date-time> · required

ISO 8601 timestamp of when the webhook was sent

Example:

"2025-08-15T14:32:00Z"

data · object · required

Show child attributes

Response

200

Webhook received successfully