Getmomo Public API (1.9.0)

Endpoints for managing deposit accounts

Endpoints for managing virtual deposit accounts for rental properties

Endpoints for polling the state of asynchronous jobs such as tax certificate and bank statement generation

Webhook events delivered to your registered endpoint.

1. In the Manager App, navigate to Integrationen (Integrations).

2. Open the Offene Schnittstelle (Public API) integration card, then select the Webhooks tab and click Neuen Webhook erstellen (Create new webhook) to register your endpoint URL and set a signing secret.

Every webhook request includes an X-Getmomo-Signature header for verifying authenticity. The signature is an HMAC-SHA256 digest of the raw JSON request body, computed with your webhook secret.

Header format: v1,<base64-encoded-signature>

Verification examples:

Node.js / TypeScript

import crypto from 'node:crypto';

function verifySignature(secret: string, body: string, header: string): boolean {
  const signature = crypto.createHmac('sha256', secret).update(body).digest('base64');
  const expected = `v1,${signature}`;
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(header));
}

Python

import hmac
import hashlib
import base64

def verify_signature(secret: str, body: bytes, header: str) -> bool:
    signature = base64.b64encode(
        hmac.new(secret.encode(), body, hashlib.sha256).digest()
    ).decode()
    expected = f"v1,{signature}"
    return hmac.compare_digest(expected, header)

Go

import (
  "crypto/hmac"
  "crypto/sha256"
  "encoding/base64"
  "fmt"
)

func VerifySignature(secret, body, header string) bool {
  mac := hmac.New(sha256.New, []byte(secret))
  mac.Write([]byte(body))
  expected := fmt.Sprintf("v1,%s", base64.StdEncoding.EncodeToString(mac.Sum(nil)))
  return hmac.Equal([]byte(expected), []byte(header))
}

C#

using System.Security.Cryptography;
using System.Text;

public static bool VerifySignature(string secret, string body, string header)
{
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(body));
    var expected = $"v1,{Convert.ToBase64String(hash)}";
    return CryptographicOperations.FixedTimeEquals(
        Encoding.UTF8.GetBytes(expected),
        Encoding.UTF8.GetBytes(header)
    );
}

Java

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;
import java.util.Base64;

public static boolean verifySignature(String secret, String body, String header) throws Exception {
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(secret.getBytes("UTF-8"), "HmacSHA256"));
    String signature = Base64.getEncoder().encodeToString(mac.doFinal(body.getBytes("UTF-8")));
    String expected = "v1," + signature;
    return MessageDigest.isEqual(expected.getBytes("UTF-8"), header.getBytes("UTF-8"));
}

Ruby

require 'openssl'
require 'base64'

def verify_signature(secret, body, header)
  signature = Base64.strict_encode64(
    OpenSSL::HMAC.digest('sha256', secret, body)
  )
  expected = "v1,#{signature}"
  Rack::Utils.secure_compare(expected, header)
end

PHP

function verifySignature(string $secret, string $body, string $header): bool {
    $signature = base64_encode(hash_hmac('sha256', $body, $secret, true));
    $expected = "v1,{$signature}";
    return hash_equals($expected, $header);
}

Always use a constant-time comparison function to prevent timing attacks.

• Events are delivered as POST requests with Content-Type: application/json
• Your endpoint must respond with a 2xx status code to acknowledge receipt
• On repeated failure (non-2xx or network error), the webhook is disabled and an email notification is sent to all managers with webhook management permissions
• Re-enable a disabled webhook from the Manager App after resolving the issue

All events share a common envelope:

{
  "type": "<EVENT_TYPE>",
  "payload": { ... }
}

The type field identifies the event. The payload shape depends on the event type.