DocsAPI ReferenceLogin
Apps

Set the app's ledger-callback endpoint

PeridotID POSTs signed ledger events here (e.g. `fiat.transfer.posted` when funds land on this app's escrow account). Returns a `pidwh_…` HMAC signing secret **once**; every callback carries `X-Pid-Signature: sha256=<hex>` over the raw body and `X-Pid-Event`. https required (http allowed for localhost). Owners only.

POST
/apps/{id}/webhook

PeridotID POSTs signed ledger events here (e.g. fiat.transfer.posted when funds land on this app's escrow account). Returns a pidwh_… HMAC signing secret once; every callback carries X-Pid-Signature: sha256=<hex> over the raw body and X-Pid-Event. https required (http allowed for localhost). Owners only.

Authorization

cookieAuth
pid_access<token>

JWT access token set by /auth/google/callback or /auth/refresh

In: cookie

Path Parameters

id*string
Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/apps/497f6eca-6276-4993-bfeb-53cbbbba6f08/webhook" \  -H "Content-Type: application/json" \  -d '{    "url": "https://live2dev.com/peridot/webhook"  }'
{  "url": "string",  "secret": "string"}

Generate or rotate an app's backend secret POST

Returns a `pidsk_…` secret **once** — only its SHA-256 hash is stored, so an existing secret can never be read back, only replaced. Afterwards, code exchange for this app requires the secret. Backend-only: never ship it in frontend code. Owners only.

Set one operation's per-app fee (stacks on the global fee) PUT

Next Page