Skip to main content

Webhook notifications

Webhooks are a system-to-system communication channel that uses a push-based strategy to send HTTP callbacks for events happening in Mambu.

For example, you can set up a webhook to notify one of your applications that a loan has been disbursed. Mambu will make a request to your application with a payload including information such as the loan account ID, client information, and amount. Your application may act directly on the request or call back to Mambu for more data or to trigger additional actions.

See also: Create webhook templates and Streaming API.

Benefits​

Audit​

The communication history records every notification sent. Each record stores the destination, timestamps, status, failure details (if any), and the exact payload rendered at send time. If a notification fails, you can resend that original payload snapshot.

Assured delivery​

Delivery is backed by an automatic retry mechanism that uses an exponential backoff policy. Only HTTP 2xx responses are considered successful; non-2xx responses, timeouts, and connection errors are treated as failures and may be retried according to platform policy. If the configured threshold is reached with no success, automatic retries stop. You can manually resend failed communications via the UI or API (where available). For more information, see Managing notifications.

Flexibility​

  • Use a URL template for the destination. The URL must be HTTP or HTTPS. Avoid quotes and disallowed placeholders in the URL. Prefer HTTPS.
  • Create payload templates in plain text, application/json, or application/xml and use placeholders. See Placeholders.
  • Supported HTTP methods: POST, PUT, and PATCH.
  • Configure custom request headers. Headers are static (no placeholder expansion). Some reserved headers may be ignored by the platform.

Idempotency​

Webhook requests include an x-notifications-idempotency-key header when this feature is enabled. Design receivers to process events idempotently and deduplicate based on this key. Retries of the same notification reuse the same key; manual resends use a new key.

Security​

  • Use HTTPS/TLS for all communications.
  • Basic authentication is supported. If you use token-based authentication, pass tokens via custom request headers.

Sender IP addresses​

Webhook requests originate from Mambu infrastructure. If you need to allowlist source IP addresses in your firewall, contact Mambu Support for the current list for your environment and region.

Webhooks vs Streaming API​

Webhooks push events to a single destination and are suitable for point-to-point integrations. The Streaming API is pull-based and better when multiple consumers need to read high-volume event streams.