Skip to main content
Most flows in these guides finish asynchronously — a PIX is paid, a card is charged, a recurring cycle settles. Portão 3 tells you about these by webhook. You register the HTTPS endpoint that receives them yourself, through the Notification API’s Webhooks section (POST /realms/{realmId}/organizations/{organizationId}/webhooks — one URL subscribed to the events you want; registering the same URL again adds events to it, and each event can be switched off and back on per webhook); deliveries are sent over HTTPS to that URL.

The notification envelope

Every webhook shares the same envelope. The event tells you what happened; the payload is the affected resource.
Webhooks can be delivered more than once. Treat notificationId as an idempotency key: record the ones you’ve processed and ignore repeats. Always respond 2xx quickly and do your processing asynchronously.

Event catalog

A subscription is a { "source", "event" } pair, and the event must belong to its source — the register endpoint rejects any other combination with a 422. These are the three sources and every event each one accepts, exactly as the API validates them.

WALLET — payments, cards and wallets

BILLING — deals and invoices

TRAVEL — bookings

A boleto charge (POST .../boleto-billing) has no webhook: read it back with GET .../boleto-billing/{boletoId} to follow its status.

Example: provisioning driven by webhooks

A common pattern is to let users self-onboard in the Portão 3 app and have your system react to webhooks rather than calling the API yourself. For example, when a user is invited and links a card, you receive: Custom fields are carried as customFields on both wallets and transactions — a map keyed by the field definition’s slug ({ "cost-center": "Projetos", "valid": true }). Resolve labels/types by fetching the definitions from the custom-fields API. Use them to attach your own identifiers — a driver’s CPF, a mileage reading, an invoice file.
Only wallet custom-field changes emit a webhook (WALLET_UPDATED). Changes to a transaction’s custom fields do not emit one — read them back from the transaction itself. (The former TRANSACTION_CUSTOM_FIELDS_UPDATED event is no longer sent.)
Webhook payloads and custom fields can carry personal data (names, CPF/CNPJ, emails, addresses). Store only what you need, keep it out of plaintext logs, and follow your own retention and minimization obligations under the LGPD.

Looking up an organization

To resolve an organization’s registration details (legal name, document, address) from its realmId and organizationId — handy when reconciling webhook payloads — use the Identity organization endpoint:
Reference: GET /realms/{realmId}/organizations/{organizationId}

Next steps

Charge with PIX

The simplest webhook-driven flow to test against.

Recurring billing with Pix Automático

The flow with the richest event lifecycle.