Ethoca Webhooks

Ethoca (a Mastercard company) delivers Alerts — early fraud and dispute notifications from issuers — to merchants. The Alerts Push API HTTPS-POSTs JSON to an endpoint you register with the Ethoca Customer Delivery Team.

When to Use This Skill

• How do I receive Ethoca Alerts webhooks (Push API)?
• How do I secure an Ethoca webhook endpoint without a signature header?
• How do I handle Ethoca fraud and dispute alerts?
• Why is there no X-Ethoca-Signature / HMAC header to verify?
• How does Ethoca mTLS (MSSL) delivery work?

Verification (core)

There is NO per-message HMAC/signature header on Ethoca Push API alerts. Do not look for X-Ethoca-Signature or a Standard Webhooks header — none exists. Trust is established primarily by the transport: