Signed CRM webhooks

The broker provides a public HTTPS receiver. MAMX calls it; the CRM does not poll a webhook endpoint for new events. Registration and updates use the broker API key.

Action	Request
Register	`POST /api/v1/mamx/webhooks` with `{"name":"primary","url":"https://crm.example.com/mamx"}`
Change URL only	`PATCH /api/v1/mamx/webhooks` with `{"url":"https://crm.example.com/new"}`
Generate a new key	Same PATCH with `{"rotate_secret":true}`
Supply a key	Set `signing_secret` in POST or PATCH (32–1,024 bytes); do not also request rotation.

One destination per configured MT5 server. Registration returns 201; an existing destination returns 409. Store the generated secret when returned: it cannot be retrieved later. Supplied secrets are not echoed. An update affects the next attempt without a restart; an in-flight delivery may still use the old URL and key. Coordinate overlap with the receiver. Redirects are not followed.

Verify before parsing

The sender signs the exact bytes of the HTTP body. Parsing and re-encoding JSON first can break the signature. Example for trusted server-side Python code:

import hashlib, hmac, json, time

def verified_event(raw_body, headers, secret):
    stamp = headers["X-MAMX-Timestamp"]
    if not stamp.isascii() or not stamp.isdecimal() or abs(time.time() - int(stamp)) > 300:
        raise ValueError("Invalid or stale timestamp")
    signed = stamp.encode("ascii") + b"." + raw_body
    digest = hmac.new(secret.encode("utf-8"), signed, hashlib.sha256).hexdigest()
    if not hmac.compare_digest("sha256=" + digest, headers["X-MAMX-Signature"]):
        raise ValueError("Invalid signature")
    return json.loads(raw_body)

Persist event_id with a unique constraint in the same CRM transaction as the state update. Return 2xx only after commit (also for an already processed ID). Delivery is at least once, not ordered. Failed responses/timeouts retry with the same ID and body but a fresh signature timestamp. No destination means events stay pending; registration can deliver an older backlog.

Event type	CRM action
`subscription.ended`	Mark the allocation inactive; refresh current state before overwriting a newer subscription.
`account.deleted`	Mark the MAMX registration deleted, not the MT5 account.
`operation.done`, `operation.rejected`, `operation.review`	Fetch the operation by ID. REVIEW is not failure confirmation or permission to repeat a withdrawal.
`fee.debited`, `fee.paid`	Track investor debit separately from credit to the payment account.
`import.review`, `import.partial_review`	Escalate to the operator. Never create a compensating trade automatically.

The envelope has event_id, type, UTC occurred_at and event-specific data. It contains no account passwords or bearer tokens.

Start here

Trading and money

CRM integration

Verify before parsing

​Verify before parsing

Verify before parsing