curl --request POST \
--url https://api.bullionwale.com/api/trading/test/v1/webhooks \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"events": [
"<string>"
],
"url": "<string>",
"description": "<string>"
}
'import requests
url = "https://api.bullionwale.com/api/trading/test/v1/webhooks"
payload = {
"events": ["<string>"],
"url": "<string>",
"description": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"active": true,
"created_at": "2026-10-21T09:30:00+00:00",
"description": "Order bot",
"environment": "production",
"events": [
"order.booked",
"order.closed"
],
"id": "5b0e8f2c-7a41-4d7e-9c3a-2f6d1e8b4a90",
"secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"secret_last4": "Qx3k",
"updated_at": "2026-10-21T09:30:00+00:00",
"url": "https://hooks.example.com/bullionwale"
}Create a webhook
Not yet available. Webhooks are implemented but switched off: these endpoints answer 404 until Bullionwale turns them on.
Test (/api/trading/test/v1): Available on request. Ask the Bullionwale desk to turn on API access for your account and issue a test key. Test orders are simulated; nothing is booked.
Production (/api/trading/v1): Switched off. Production trading is implemented but not available: orders are refused with 403 production_trading_disabled. Once it opens, Bullionwale enables production access per account (see Production access requirements).
Register an HTTPS endpoint for this environment’s events. The response carries the signing secret, the only time it is shown.
curl --request POST \
--url https://api.bullionwale.com/api/trading/test/v1/webhooks \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"events": [
"<string>"
],
"url": "<string>",
"description": "<string>"
}
'import requests
url = "https://api.bullionwale.com/api/trading/test/v1/webhooks"
payload = {
"events": ["<string>"],
"url": "<string>",
"description": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"active": true,
"created_at": "2026-10-21T09:30:00+00:00",
"description": "Order bot",
"environment": "production",
"events": [
"order.booked",
"order.closed"
],
"id": "5b0e8f2c-7a41-4d7e-9c3a-2f6d1e8b4a90",
"secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"secret_last4": "Qx3k",
"updated_at": "2026-10-21T09:30:00+00:00",
"url": "https://hooks.example.com/bullionwale"
}Authorizations
Body
Response
Successful Response
test or production: the events it receives.
The signing secret (whsec_...). Shown only in this response: store it now.
The last 4 characters of the signing secret.