Partners
WebhooksEvent reference

raffle.drawn

A prize winner has been drawn

Carries the VRF fairness proof, identical for every platform on the raffle.

winner_external_user_ref is null when the winner is not one of your buyers, and no partner payload ever contains a wallet address. winner_display_name is the exception: it is shared with every platform so the result reads the same everywhere.

Verify vrf.provider before presenting this as a fair draw — see the fairness schema.

Request Body

application/json
  1. body

Every webhook uses this envelope.

Headers: x-verity-event: <event name> and x-verity-signature: <hex>.

The signature is HMAC-SHA256 of the exact raw body bytes with your webhook secret, hex encoded. Verify before parsing:

import { createHmac, timingSafeEqual } from "node:crypto";function verify(rawBody, header, secret) {  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");  const a = Buffer.from(expected), b = Buffer.from(header ?? "");  return a.length === b.length && timingSafeEqual(a, b);}

Respond 2xx to acknowledge. Non-2xx and timeouts are retried with backoff, so your handler must be idempotent. You only ever receive data about your own buyers.

event*string
Value in"payment.updated""raffle.live""raffle.closed""raffle.drawn""prize.won""raffle.cancelled""refund.sent"
data*

Response Body

Acknowledged.

Example Requests
POST/raffle.drawn

Every webhook uses this envelope.

Headers: x-verity-event: <event name> and x-verity-signature: <hex>.

The signature is HMAC-SHA256 of the exact raw body bytes with your webhook secret, hex encoded. Verify before parsing:

import { createHmac, timingSafeEqual } from "node:crypto";function verify(rawBody, header, secret) {  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");  const a = Buffer.from(expected), b = Buffer.from(header ?? "");  return a.length === b.length && timingSafeEqual(a, b);}

Respond 2xx to acknowledge. Non-2xx and timeouts are retried with backoff, so your handler must be idempotent. You only ever receive data about your own buyers.

Request Body
application/json
{  "event": "raffle.drawn",  "data": {    "raffle_id": 77,    "prize_id": 41,    "winning_ticket": "R077-T00412",    "winner_display_name": "alice",    "winner_external_user_ref": "usr_8812",    "eligible_ticket_count": 4210,    "vrf": {      "provider": "orao",      "randomness_account": "7bXk...",      "tx_signature": "4Nc9...",      "random_value": "88231904772"    }  }}