Openapi
Receive an incoming organization webhook. POST
Accepts a public token URL, verifies the HMAC-SHA256 signature (`x-centrakit-signature` over `{timestamp}.{body}` within five minutes) or the shared secret header, and starts matching workflows. Bodies over 256 KB are rejected.
Record an invoice payment. POST
Records a manual payment (bank transfer, cash, card, or other) against a sent or overdue invoice. Partial payments keep the invoice open; the payment that settles the balance marks it paid.