Overview

BMG Money webhooks push real-time notifications to your system as your files move through our pipeline. Instead of polling for status, you register an HTTPS endpoint once and we call it the moment something happens — a file passes validation, fails, errors out, or a deduction file becomes ready for download.

How it works

1. Subscribe — register your HTTPS endpoint and the events you want (see Subscriptions). For file notifications, subscribe to the file topic.
2. Receive — we POST a JSON payload ({ "event": ..., "data": ... }) to your endpoint, signed with HMAC-SHA256 (see Security).
3. Acknowledge — respond 2xx within 5 seconds. Failed or slow deliveries are retried up to 5 times.
4. Audit — inspect every delivery attempt via the Deliveries endpoint.

Authentication

Webhook management uses the same OAuth 2.0 Bearer token as the rest of the LAW API (see Authentication). Your company context is derived from the token — you do not send any additional identification headers.

Header	Required	Description
Authorization	Yes	Bearer <access_token> (OAuth 2.0 client credentials).
Content-Type	Yes	application/json.

Management endpoints

Operation	Endpoint
Create subscription	POST /law/api/v1/subscriptions/
List subscriptions	GET /law/api/v1/subscriptions/
Get / update / delete subscription	GET / PUT / DELETE /law/api/v1/subscriptions/{id}
List delivery attempts	GET /law/api/v1/deliveries
Get delivery by id	GET /law/api/v1/deliveries/{id}
Trigger a test event (Sandbox only)	POST /law/api/v1/webhook-trigger

Base URLs: https://sandbox.bmgmoney.com (testing) and https://api.bmgmoney.com (production).

Start here: the guide Receiving the Deduction File walks the full flow end to end — subscription, payload, signature validation, download, and sandbox testing.