> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dwsoffshorepartners.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register a webhook destination

> Register an owned public HTTPS receiver with an idempotency key, select workflow events and securely retain the signing secret returned once.

Register an Ultiwrite webhook receiver you control using an approved dashboard key with read and evidence permissions. The endpoint below uses the [canonical Ultiwrite OpenAPI contract](https://dwsoffshorepartners.com/.well-known/openapi.json). The configured service permits at most ten active destinations for your account.

Send JSON `url` and `events` with the required `Idempotency-Key`. A new registration returns its signing secret once. An identical retry returns the same endpoint without redisclosing that secret; a different URL or event selection under the same key conflicts. Destinations are immutable and redirects are not followed.

[Verify the exact raw-body HMAC and handle repeated events](https://docs.dwsoffshorepartners.com/partner-api/workflow.md#webhook-notifications). Notification registration does not advance a case or spend analysis credits.


## OpenAPI

````yaml https://dwsoffshorepartners.com/.well-known/openapi.json POST /webhooks
openapi: 3.1.0
info:
  title: Ultiwrite API
  version: '2026-11-01'
  description: >-
    Ultiwrite is operated by DWS Offshore Fund dba Ultiwrite. Ultiwrite examines
    the documents and evidence behind opportunities, organizations,
    counterparties, acquisitions, financings and portfolios, and returns
    released findings: source economics, document integrity, material
    contradictions, unresolved claims and the next diligence move. The API never
    renders an autonomous approve or decline.


    Partner API (dashboard API key or OAuth 2.1): explicitly approved accounts
    submit evidence, continue asynchronous processing and read the released
    report. Polling uses API requests but no additional analysis credits.
    Reports are never assumed to be immediate.


    Provisioned routes authenticate with an admin-issued uw_live_ API key and
    are listed by name only.


    Versioning: the major version is in the path (/api/v1). Within v1, changes
    are additive; a field or operation is removed only after a deprecation
    notice in this document (deprecated: true) and the changelog. Response
    header Ultiwrite-Api-Version identifies the contract revision.


    API access requires an explicit administrator grant, independent of paid
    plan. Monthly and fixed-minute request limits are pooled across every key
    and partner OAuth grant on the account. Every admitted request, including
    polling and authenticated validation errors, uses one request; failed
    authentication and quota denials do not. Analysis credits use the existing
    separate ledger. Exceeding a limit returns 429 with Retry-After.
  contact:
    name: Ultiwrite
    url: https://dwsoffshorepartners.com/contact
  termsOfService: https://dwsoffshorepartners.com/terms
servers:
  - url: https://dwsoffshorepartners.com/api/v1
    description: Production v1
security: []
tags:
  - name: Account
    description: Who the token acts for, what the API supports, and analysis allowance.
  - name: Cases
    description: Submit evidence packages and follow the asynchronous analysis workflow.
  - name: Results
    description: Released findings and Decision Briefs. Reads never run the engine.
  - name: Reports
    description: Delivery options for released reports.
  - name: Provisioned (API key)
    description: Pre-existing provisioned server-to-server routes.
externalDocs:
  description: Developer documentation
  url: https://dwsoffshorepartners.com/docs/api
paths:
  /webhooks:
    post:
      tags:
        - Webhooks
      summary: Subscribe a public HTTPS receiver to workflow metadata
      description: >-
        At most ten active subscriptions per account. Dashboard API key only.
        Returns a signing secret once; retries return the same subscription
        without redisclosing the secret. The destination receives case workflow
        IDs and publication metadata, never files, titles, findings, decisions
        or report text. Deliveries may repeat or arrive out of order; use event
        IDs and read current case status.
      operationId: createWebhook
      parameters:
        - name: Idempotency-Key
          in: header
          required: true
          description: >-
            Stable 8–100 character request key. Reuse only with exactly the same
            URL/events.
          schema:
            type: string
            pattern: ^[A-Za-z0-9_-]{8,100}$
      requestBody:
        required: true
        description: >-
          Public HTTPS destination without query, credentials, fragment, literal
          IP or custom port; distinct event names.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateWebhook'
      responses:
        '200':
          description: Idempotent retry; no signing secret.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookCreated'
        '201':
          description: Created; signing secret returned once.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookCreated'
        '400':
          description: >-
            Invalid input. No new evidence package was accepted. If
            authenticated and admitted, the request counts toward the API
            request allowance.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: >-
            Missing, invalid, expired or revoked token, or a token issued for
            another resource. See WWW-Authenticate.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: >-
            Explicit account API approval is missing or the credential lacks a
            required scope.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: >-
            Not found in the authorized organization, or the API is not enabled.
            Another organization’s records are indistinguishable from absent
            ones.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: >-
            Conflict with the saved case (for example a frozen
            document-forensics choice).
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '413':
          description: Package too large for a direct request. Use an upload link.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '415':
          description: Unsupported request media type.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: >-
            Account monthly request allowance, rate limit or concurrency budget
            exceeded. See Retry-After.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
            Retry-After:
              description: >-
                Suggested delay in seconds before retrying; present for
                rate/quota denials and transient failures with a known retry
                window.
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '503':
          description: Temporarily unavailable. See Retry-After. No completion is claimed.
          headers:
            X-Request-Id:
              description: Request correlation id.
              schema:
                type: string
            X-Api-Requests-Limit:
              description: >-
                Monthly account API request limit. Present after successful
                admission.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Remaining:
              description: >-
                Monthly requests remaining immediately after this request was
                admitted; other concurrent requests may reduce it.
              schema:
                type: integer
                minimum: 0
            X-Api-Requests-Reset:
              description: >-
                Next UTC calendar-month reset as an ISO 8601 timestamp. Present
                after successful admission.
              schema:
                type: string
                format: date-time
            Retry-After:
              description: >-
                Suggested delay in seconds before retrying; present for
                rate/quota denials and transient failures with a known retry
                window.
              schema:
                type: integer
                minimum: 1
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - UltiwriteApiKey: []
        - UltiwriteOAuth:
            - ultiwrite:read
            - ultiwrite:evidence
components:
  schemas:
    CreateWebhook:
      type: object
      additionalProperties: false
      required:
        - url
        - events
      properties:
        url:
          type: string
          maxLength: 500
          format: uri
        events:
          type: array
          minItems: 1
          maxItems: 6
          uniqueItems: true
          items:
            type: string
            enum:
              - analysis.created
              - evidence.received
              - analysis.processing
              - analysis.completed
              - analysis.failed
              - report.available
    WebhookCreated:
      type: object
      additionalProperties: false
      required:
        - created
        - endpoint
        - signingSecret
      properties:
        created:
          type: boolean
        endpoint:
          $ref: '#/components/schemas/WebhookEndpoint'
        signingSecret:
          type:
            - string
            - 'null'
          description: Returned only on the first successful creation.
    Error:
      type: object
      additionalProperties: false
      required:
        - error
      properties:
        error:
          type: object
          additionalProperties: false
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
              description: >-
                Stable machine-readable code, for example invalid_input,
                invalid_token, api_access_denied, insufficient_scope,
                api_quota_exceeded, not_found, choice_frozen, file_too_large,
                refused_content, rate_limited, deadline, service_unavailable.
            message:
              type: string
              description: >-
                Safe human-readable explanation. Never contains credentials,
                stack traces or document text.
            requestId:
              type: string
              description: Echo of the X-Request-Id response header. Quote it to support.
    WebhookEndpoint:
      type: object
      additionalProperties: false
      required:
        - id
        - url
        - events
        - status
        - createdAt
        - revokedAt
      properties:
        id:
          type: string
        url:
          type: string
        events:
          type: array
          items:
            type: string
        status:
          type: string
          enum:
            - active
            - revoked
        createdAt:
          type: string
        revokedAt:
          type:
            - string
            - 'null'
  securitySchemes:
    UltiwriteApiKey:
      type: http
      scheme: bearer
      bearerFormat: ultiwrite_live_*
      description: >-
        Create a key at /settings/api after an administrator approves your
        account. The key is shown once, can be revoked, and shares the account
        request allowance with other keys and partner OAuth grants. Send only in
        Authorization. These keys are not accepted by MCP or the legacy
        provisioned routes.
    UltiwriteOAuth:
      type: oauth2
      description: >-
        OAuth 2.1 authorization code with PKCE (S256), public clients
        (token_endpoint_auth_method none). Register a client (RFC 7591) at
        https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/register;
        registration accepts only approved HTTPS callbacks or a native loopback
        callback http://127.0.0.1:<port>/callback with application_type native.
        Send resource=https://dwsoffshorepartners.com/api/v1 (RFC 8707) on the
        authorization and token requests; tokens for any other resource are
        refused. Access tokens last 10 minutes; refresh tokens last 14 days and
        rotate; authorization codes expire after 60 seconds.
      flows:
        authorizationCode:
          authorizationUrl: >-
            https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/authorize
          tokenUrl: >-
            https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/token
          refreshUrl: >-
            https://dwsoffshorepartners.com/api/integrations/ultiwrite/oauth/token
          scopes:
            ultiwrite:read: >-
              Read cases, status, released reports, Decision Briefs and delivery
              options in the authorized organization.
            ultiwrite:evidence: >-
              Submit authorized evidence for analysis in the authorized
              organization.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.