Invitation claimed webhook

Webhook that is called when an invitation is claimed by a customer. This endpoint should be implemented by platform clients of the Grid API.

When a customer claims an invitation, this webhook is triggered to notify the platform that:

1. The invitation has been successfully claimed
2. The invitee UMA address is now associated with the invitation
3. The invitation status has changed from PENDING to CLAIMED

This allows platforms to:

• Track invitation usage and conversion rates
• Trigger onboarding flows for new customers who joined via invitation
• Apply referral bonuses or rewards to the inviter
• Update their UI to reflect the claimed status

Authentication

The webhook includes a signature in the X-Grid-Signature header that allows you to verify that the webhook was sent by Grid. To verify the signature:

1. Get the Grid public key provided to you during integration
2. Decode the base64 signature from the header
3. Create a SHA-256 hash of the request body
4. Verify the signature using the public key and the hash

If the signature verification succeeds, the webhook is authentic. If not, it should be rejected.

WEBHOOK invitation-claimed

claimedInvitation

{
  "id": "Webhook:019542f5-b3e7-1d02-0000-000000000008",
  "type": "INVITATION.CLAIMED",
  "timestamp": "2025-09-01T15:45:00Z",
  "data": {
    "code": "019542f5",
    "createdAt": "2025-09-01T14:30:00Z",
    "claimedAt": "2025-09-01T15:45:00Z",
    "inviterUma": "$[e-mail]",
    "inviteeUma": "$[e-mail]",
    "status": "CLAIMED",
    "url": "https://uma.me/i/019542f5"
  }
}

400

{
  "message": "<string>",
  "details": {}
}

Authorizations

X-Grid-Signature · string · header · required

Secp256r1 (P-256) asymmetric signature of the webhook payload, which can be used to verify that the webhook was sent by Grid. To verify the signature:

1. Get the Grid public key provided to you during integration
2. Decode the base64 signature from the header
3. Create a SHA-256 hash of the request body
4. Verify the signature using the public key and the hash

If the signature verification succeeds, the webhook is authentic. If not, it should be rejected.

Body

application/json

id · string · required

Unique identifier for this webhook delivery (can be used for idempotency)

Example:

"Webhook:019542f5-b3e7-1d02-0000-000000000007"

type · enum<string> · required

Status-specific event type in OBJECT.EVENT dot-notation (e.g., OUTGOING_PAYMENT.COMPLETED)

Available options: INVITATION.CLAIMED

timestamp · string<date-time> · required

ISO 8601 timestamp of when the webhook was sent

Example:

"2025-08-15T14:32:00Z"

data · object · required

Show child attributes

Response

200

Webhook received successfully