didit-sdk 1.0.0

data/lib/didit/resources/wallet_screening.rb

@@ -0,0 +1,190 @@
+# Code generated by codegen from openapi/*.json. DO NOT EDIT.
+# frozen_string_literal: true
+
+module Didit
+  module Resources
+    # The +wallet_screening+ resource.
+    class WalletScreening < Didit::Resource
+      # Screen a wallet address
+      #
+      # Run on-demand AML screening for a single crypto wallet/address without creating a transaction. Resolves your
+      # application's configured blockchain analytics provider, screens the address synchronously, and returns the
+      # normalised risk result. LIGHTNING is available only with an Elliptic or Chainalysis BYOK connection added
+      # through Marketplace. Nothing is written to the transactions table. One AML monitoring usage is billed per
+      # successful screening (sandbox applications are not billed).
+      #
+      # +POST /v3/wallet-screening/+
+      #
+      # @param wallet_address [String] The crypto address or network identifier to screen. Must match the selected
+      #   network (e.g. a `0x`-prefixed 40-hex-char address for EVM chains). Alias: `address`.
+      # @param blockchain [String] Network identifier. Managed screening supports BTC, ETH, LTC, XRP, BCH, DOGE, TRX,
+      #   SOL, MATIC, BNB, BASE (Base), OP (Optimism), and ARB (Arbitrum One). USDT and USDC are legacy Ethereum
+      #   aliases, not multi-network searches. Connected-provider coverage varies. LIGHTNING requires a supported
+      #   connected provider. CELO (Celo), MODE (Mode) and PLUME (Plume) are screened through a connected TRM Labs
+      #   acco...
+      # @param direction [String] Optional. Whether the address is being screened as an inbound (deposit) or outbound
+      #   (withdrawal) counterparty. Accepts `inbound`, `outbound`, `deposit`, or `withdrawal`. Defaults to a neutral
+      #   pre-transfer screen when omitted. This is passed to the provider as context only; it does not change the
+      #   returned `risk_score`, `severity`, or the `source_of_funds`/`destination_of_funds` breakdowns, which a...
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::WalletScreeningResult]
+      def screen(wallet_address:, blockchain:, direction: OMIT, request_options: nil)
+        @client.request(
+          :post,
+          "/v3/wallet-screening/",
+          body: {
+            "wallet_address" => wallet_address,
+            "blockchain" => blockchain,
+            "direction" => direction
+          },
+          response: Types::WalletScreeningResult,
+          request_options: request_options
+        )
+      end
+
+      # Render a wallet-screening result as a PDF
+      #
+      # Stateless companion to `POST /v3/wallet-screening/`: repost the exact JSON body that endpoint returned -
+      # including the `report_signature` it added - and get back a Didit-branded PDF of the same result. No provider
+      # is called and nothing is billed or persisted; this only re-renders a result Didit already produced. The
+      # signature ties the PDF to an unmodified result: editing `risk_score`, `severity`, `sanctions_hit`, or any
+      # other signed field before reposting fails with `400`.
+      #
+      # +POST /v3/wallet-screening/pdf/+
+      #
+      # @param provider [String] Provider that performed the screening (e.g. `merklescience`, `crystal`).
+      # @param screening_type [String] Always `WALLET_SCREENING` for this endpoint.
+      # @param risk_score [Integer] Normalised 0-100 risk score. Higher means greater exposure to risky entities.
+      #   Merkle Science grades an address 0-5, which maps to 0, 15, 35, 55, 75 or 95.
+      # @param severity [String] Risk bucket derived from `risk_score`: `0-9` UNKNOWN, `10-39` LOW, `40-69` MEDIUM,
+      #   `70-89` HIGH, `90-100` CRITICAL. `UNKNOWN` is the lowest band, not a separate no-data state: `risk_score` 0
+      #   (the common clean-address case) means no adverse assessment, while a non-zero score in the 1-9 range is a real
+      #   but sub-LOW signal - read the `risk_score`, not just the band. Never treat `UNKNOWN` as an affirm...
+      # @param status [String] Screening outcome status.
+      # @param summary [String] Human-readable summary of the screening result.
+      # @param wallet_address [String] The screened address, echoed back.
+      # @param blockchain [String] The blockchain that was screened.
+      # @param source_of_funds [Array<Hash>] Where the address received funds from, attributed by entity. Each entry
+      #   is an exposure breakdown.
+      # @param destination_of_funds [Array<Hash>] Where the address sent funds to, attributed by entity. Same item
+      #   shape as `source_of_funds` with `exposure_direction` = `outgoing`.
+      # @param counterparty_connections [Array<Hash>] Entities the provider attributes the screened address to. For
+      #   Merkle Science these come from the address's own owner and user tags, so the same entity can appear twice, and
+      #   they carry no fund flows: `received_usd`, `sent_usd`, `received_hops` and `sent_hops` are `null` and
+      #   `percentage` is 0. Do not route on `risk_level` or `is_direct` here: use `sanctions_hit`,
+      #   `dominant_risk_category` and `risk_...
+      # @param sanctions_hit [Boolean] True if the address has direct or indirect sanctions exposure.
+      # @param dominant_risk_category [String, nil] Highest-weighted high-risk category, or `null` when none is
+      #   dominant (e.g. `sanctioned`, `mixer`, `stolen_funds`).
+      # @param report_signature [String] Opaque HMAC-SHA256 signature over this exact result, scoped to your
+      #   application. Not meaningful on its own - repost the full response body, unmodified and including this field,
+      #   to `POST /v3/wallet-screening/pdf/` to render it as a PDF. The PDF endpoint rejects the request with `400` if
+      #   `report_signature` is missing or if any signed field (e.g. `risk_score`, `severity`, `sanctions_hit`) was
+      #   edited...
+      # @param transaction_hash [String, nil] Transaction screening field, shared with the result shape. Always `null`
+      #   on a wallet screening result.
+      # @param block_timestamp [String, nil] Transaction screening field, shared with the result shape. Always `null`
+      #   on a wallet screening result.
+      # @param total_value_usd [Numeric, nil] Transaction screening field, shared with the result shape. Always `null`
+      #   on a wallet screening result.
+      # @param fee_usd [Numeric, nil] Transaction screening field, shared with the result shape. Always `null` on a
+      #   wallet screening result.
+      # @param sender_rows [Array<Hash>] Transaction screening field, shared with the result shape. Always empty on a
+      #   wallet screening result.
+      # @param receiver_rows [Array<Hash>] Transaction screening field, shared with the result shape. Always empty on
+      #   a wallet screening result.
+      # @param transaction_flows [Array<Hash>] Transaction screening field, shared with the result shape. Always empty
+      #   on a wallet screening result.
+      # @param transaction_flows_status [String, nil] Transaction screening field, shared with the result shape.
+      #   Always `null` on a wallet screening result.
+      # @param transaction_flows_error [String, nil] Transaction screening field, shared with the result shape. Always
+      #   `null` on a wallet screening result.
+      # @param network_nodes [Array<Hash>] Exposure graph nodes for transaction screening. Empty on a wallet screening
+      #   result.
+      # @param network_edges [Array<Hash>] Exposure graph edges for transaction screening. Empty on a wallet screening
+      #   result.
+      # @param pep_counterparty [Boolean, nil] Politically exposed person exposure. `null` when no PEP finding is
+      #   available, which is every result today because no provider reports one; `false` only for an explicit negative
+      #   screening result. Do not read `null` as a completed PEP check.
+      # @param risk_factors [Array<Hash>] Ranked explanation of `risk_score`: what produced this verdict. Providers
+      #   grade an address on their own model and return only a verdict (Merkle Science returns an integer 0-5), so the
+      #   score alone is not actionable. Ordered high-risk first, then by the value that moved through each driver,
+      #   capped at the five strongest; `source_of_funds` and `destination_of_funds` always carry the complete
+      #   breakdow...
+      # @param raw_response [Hash] The provider's own payload. Its shape is provider-specific and can change without
+      #   notice: read the normalised fields instead of parsing it.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [String, nil] the body bytes, or nil when a block receives the chunks
+      def screen_pdf(
+        provider:,
+        screening_type:,
+        risk_score:,
+        severity:,
+        status:,
+        summary:,
+        wallet_address:,
+        blockchain:,
+        source_of_funds:,
+        destination_of_funds:,
+        counterparty_connections:,
+        sanctions_hit:,
+        dominant_risk_category:,
+        report_signature:,
+        transaction_hash: OMIT,
+        block_timestamp: OMIT,
+        total_value_usd: OMIT,
+        fee_usd: OMIT,
+        sender_rows: OMIT,
+        receiver_rows: OMIT,
+        transaction_flows: OMIT,
+        transaction_flows_status: OMIT,
+        transaction_flows_error: OMIT,
+        network_nodes: OMIT,
+        network_edges: OMIT,
+        pep_counterparty: OMIT,
+        risk_factors: OMIT,
+        raw_response: OMIT,
+        request_options: nil,
+        &block
+      )
+        @client.request(
+          :post,
+          "/v3/wallet-screening/pdf/",
+          body: {
+            "provider" => provider,
+            "screening_type" => screening_type,
+            "risk_score" => risk_score,
+            "severity" => severity,
+            "status" => status,
+            "summary" => summary,
+            "wallet_address" => wallet_address,
+            "blockchain" => blockchain,
+            "source_of_funds" => source_of_funds,
+            "destination_of_funds" => destination_of_funds,
+            "counterparty_connections" => counterparty_connections,
+            "sanctions_hit" => sanctions_hit,
+            "dominant_risk_category" => dominant_risk_category,
+            "report_signature" => report_signature,
+            "transaction_hash" => transaction_hash,
+            "block_timestamp" => block_timestamp,
+            "total_value_usd" => total_value_usd,
+            "fee_usd" => fee_usd,
+            "sender_rows" => sender_rows,
+            "receiver_rows" => receiver_rows,
+            "transaction_flows" => transaction_flows,
+            "transaction_flows_status" => transaction_flows_status,
+            "transaction_flows_error" => transaction_flows_error,
+            "network_nodes" => network_nodes,
+            "network_edges" => network_edges,
+            "pep_counterparty" => pep_counterparty,
+            "risk_factors" => risk_factors,
+            "raw_response" => raw_response
+          },
+          response: :binary,
+          accept: "application/pdf, application/json",
+          request_options: request_options, &block
+        )
+      end
+    end
+  end
+end

data/lib/didit/resources/webhooks.rb

@@ -0,0 +1,396 @@
+# Code generated by codegen from openapi/*.json. DO NOT EDIT.
+# frozen_string_literal: true
+
+module Didit
+  module Resources
+    # The +webhooks+ resource.
+    class Webhooks < Didit::Resource
+      include ::Didit::Webhooks::ClientMethods
+
+      # @return [Didit::Resources::Webhooks::Destinations]
+      def destinations
+        @destinations ||= Destinations.new(@client)
+      end
+
+      # Get webhook configuration
+      #
+      # Return the application's webhook settings in one call: every [webhook
+      # destination](https://docs.didit.me/management-api/webhook/list-destinations) with its signing secret, the
+      # event types a destination can subscribe to, the application-level (legacy) webhook URL, version and secret,
+      # the data and biometric-template retention policy, and the Digital ID wallet return hosts. Didit delivers
+      # webhooks to destinations, each signed with its own `secret_shared_key`; the top-level `webhook_url`,
+      # `webhook_version` and `secret_shared_key` are used only while no destination is enabled, and then only for
+      # `status.updated` and `data.updated`. The response contains signing secrets, so keep it out of logs and
+      # client-side code. A scoped API key needs `webhooks: read`.
+      #
+      # +GET /v3/webhook/+
+      #
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::WebhookConfig]
+      def retrieve_config(request_options: nil)
+        @client.request(
+          :get,
+          "/v3/webhook/",
+          response: Types::WebhookConfig,
+          request_options: request_options
+        )
+      end
+
+      # Update webhook configuration
+      #
+      # Partially update application-level settings: the legacy webhook URL, version and secret, the data and
+      # biometric-template retention policy, and the Digital ID wallet return hosts. Send only the fields to change;
+      # the response is the full configuration, the same shape as `GET /v3/webhook/`. Destinations are not managed
+      # here: create, update and delete them with the `/v3/webhook/destinations/` endpoints, and do not send an
+      # `endpoints` field to this endpoint. A `data_retention_months` change also applies to existing sessions, and
+      # sessions it deletes cannot be restored; read [Data retention](https://docs.didit.me/console/data-retention)
+      # first. A scoped API key needs `webhooks: write`.
+      #
+      # +PATCH /v3/webhook/+
+      #
+      # @param webhook_url [String, nil] Legacy application-level webhook URL. Didit uses it only while the
+      #   application has no enabled destination, and then only for `status.updated` and `data.updated`. It does not
+      #   create a destination, and the next create, update or delete of a destination replaces it. To receive webhooks,
+      #   create a destination with `POST /v3/webhook/destinations/` instead.
+      # @param webhook_version [String] Payload version of the legacy `webhook_url`.
+      # @param rotate_secret_key [Boolean] `true` replaces the application-level `secret_shared_key` with a new random
+      #   value at once; the new value is in the response. Destination secrets are not changed. Every call with `true`
+      #   generates a new secret, so it is not idempotent.
+      # @param capture_method [String] Legacy application setting. The verification flow does not read it.
+      # @param data_retention_months [Integer, nil] Automatic deletion window in months (a month counts as 30 days),
+      #   or `null` for no automatic deletion. A change applies to existing sessions too: every user verification
+      #   session older than the new window is deleted automatically, and that deletion is irreversible.
+      # @param face_retention_policy [String] What happens to a session's face embedding when the session is deleted.
+      #   `retain_until_user_deleted` needs `face_retention_days` in the same request or already set. A change applies
+      #   to session deletions from then on; it creates or purges no existing biometric template.
+      # @param face_retention_days [Integer, nil] Retention period, in days, of biometric templates under
+      #   `retain_until_user_deleted`.
+      # @param biometric_consent_mode [String] When the hosted flow and the native SDKs ask the person for explicit
+      #   biometric consent before a face capture. `auto` (default) asks only where a trigger applies: a declared state,
+      #   the person's IP, or the identity document's issuer is in Illinois, Texas or Colorado, or the person looks to
+      #   be in the US without a known state. `always` asks every person whose workflow captures a face. `never` never
+      #   s...
+      # @param allowed_return_hosts [Array<String>] Replaces the whole list of Digital ID wallet return hosts. Bare
+      #   hostnames only, such as `shop.example.com`: no scheme, port, path or wildcard. Values are lowercased and
+      #   duplicates are dropped. Send `[]` to clear the list.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::WebhookConfig]
+      def update_config(
+        webhook_url: OMIT,
+        webhook_version: OMIT,
+        rotate_secret_key: OMIT,
+        capture_method: OMIT,
+        data_retention_months: OMIT,
+        face_retention_policy: OMIT,
+        face_retention_days: OMIT,
+        biometric_consent_mode: OMIT,
+        allowed_return_hosts: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :patch,
+          "/v3/webhook/",
+          body: {
+            "webhook_url" => webhook_url,
+            "webhook_version" => webhook_version,
+            "rotate_secret_key" => rotate_secret_key,
+            "capture_method" => capture_method,
+            "data_retention_months" => data_retention_months,
+            "face_retention_policy" => face_retention_policy,
+            "face_retention_days" => face_retention_days,
+            "biometric_consent_mode" => biometric_consent_mode,
+            "allowed_return_hosts" => allowed_return_hosts
+          },
+          response: Types::WebhookConfig,
+          request_options: request_options
+        )
+      end
+
+      # The +webhooks.destinations+ resource.
+      class Destinations < Didit::Resource
+        # Create webhook destination
+        #
+        # Create a webhook destination. The response includes the auto-generated `secret_shared_key` HMAC signing
+        # secret (also readable later via `GET /v3/webhook/destinations/{destination_uuid}/`). Always send
+        # `subscribed_events` with at least one event (no wildcards): an explicit empty list is rejected with 400, and
+        # omitting the field creates a destination subscribed to nothing, which never receives a webhook. The
+        # `(application, url)` pair must be unique among the application's destinations.
+        #
+        # +POST /v3/webhook/destinations/+
+        #
+        # @param label [String] Human-readable name displayed in Console → Webhooks. Helps distinguish destinations
+        #   when you have several (e.g. "Prod", "Staging mirror").
+        # @param url [String] HTTPS URL that will receive `POST` requests. Must be unique among the application's
+        #   destinations. Use a stable, hardened endpoint: Didit retries failed deliveries on a backoff schedule.
+        # @param enabled [Boolean] When `false`, the destination is saved but Didit will not push any webhooks to it.
+        #   Useful for staging configs you want to keep parked.
+        # @param webhook_version [String] Payload schema version Didit will send. `v3` is the current/recommended
+        #   format; older versions are kept for backward compatibility with legacy integrations.
+        # @param subscribed_events [Array<String>] Events to deliver. Effectively required: an explicit `[]` is
+        #   rejected with 400, and omitting the field creates a destination with no subscriptions that receives nothing.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::WebhooksDestinationsCreateResponse]
+        def create(label:, url:, enabled: OMIT, webhook_version: OMIT, subscribed_events: OMIT, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/webhook/destinations/",
+            body: {
+              "label" => label,
+              "url" => url,
+              "enabled" => enabled,
+              "webhook_version" => webhook_version,
+              "subscribed_events" => subscribed_events
+            },
+            response: Types::WebhooksDestinationsCreateResponse,
+            request_options: request_options
+          )
+        end
+
+        # Delete webhook destination
+        #
+        # Permanently delete a webhook destination, its signing secret and its entire delivery log. This cannot be
+        # undone. No new webhook is sent to the destination's URL; other destinations subscribed to the same events
+        # keep receiving them. Afterwards the destination no longer appears in `GET /v3/webhook/destinations/`, and
+        # every route under `/v3/webhook/destinations/{destination_uuid}/`, including its deliveries, a delivery's
+        # detail and its resend, answers 404. The application's legacy `webhook_url` is set to the URL of the oldest
+        # remaining enabled destination, or cleared when no enabled destination is left. Calling DELETE again returns
+        # 404.
+        #
+        # +DELETE /v3/webhook/destinations/{destination_uuid}/+
+        #
+        # @param destination_uuid [String] UUID of the destination to delete.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [nil]
+        def delete(destination_uuid, request_options: nil)
+          @client.request(
+            :delete,
+            "/v3/webhook/destinations/{destination_uuid}/",
+            path_params: { "destination_uuid" => destination_uuid },
+            request_options: request_options
+          )
+        end
+
+        # List webhook destinations
+        #
+        # List all webhook destinations (unpaginated array, oldest first). Each item carries the destination's
+        # configuration, its delivery metrics for the last 30 days (`metrics_window_days`) with one `daily_points`
+        # entry per day, and its health (`health_status`, `failing_streak`, `failing_since`, `last_success_at`). The
+        # list has no `summary` object and never includes the signing secret: each item shows only `secret_last4`.
+        # Fetch a single destination (`GET /v3/webhook/destinations/{destination_uuid}/`) to read `secret_shared_key`.
+        #
+        # +GET /v3/webhook/destinations/+
+        #
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Array<Didit::Types::WebhooksDestinationsListResponseItem>]
+        def list(request_options: nil)
+          @client.request(
+            :get,
+            "/v3/webhook/destinations/",
+            response: [:array, Types::WebhooksDestinationsListResponseItem],
+            request_options: request_options
+          )
+        end
+
+        # List webhook destination deliveries
+        #
+        # Page through every delivery attempt to one webhook destination, newest first. The first send of each event,
+        # each automatic [retry](https://docs.didit.me/integration/webhooks#retry-policy) and each resend are separate
+        # entries. Entries carry the HTTP status and response time but not the payload: fetch one delivery to read its
+        # headers and body. `count` is exact up to 100 and reads 100 above that, so follow `next` until it is `null`.
+        # Delivery records are available for about 30 days. A scoped API key needs `webhooks: read` and `decisions:
+        # read`; a key limited to some workflows or to approved sessions cannot use this endpoint.
+        #
+        # +GET /v3/webhook/destinations/{destination_uuid}/deliveries/+
+        #
+        # @param destination_uuid [String] UUID of the destination (the `uuid` returned by `GET
+        #   /v3/webhook/destinations/`).
+        # @param limit [Integer] Maximum number of deliveries per page. Defaults to 50. A value that is not a positive
+        #   integer falls back to 50; a value above 1000000 returns `400`.
+        # @param offset [Integer] Number of deliveries to skip. Defaults to 0. Prefer following the `next` and
+        #   `previous` URLs from the response.
+        # @param date_from [Date, String] First UTC day to include, as `YYYY-MM-DD` (inclusive). Omit to start from
+        #   the oldest delivery available. `dateFrom` is accepted as an alias.
+        # @param date_to [Date, String] Last UTC day to include, as `YYYY-MM-DD` (inclusive). Must not be earlier than
+        #   `date_from`. `dateTo` is accepted as an alias.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Page<Didit::Types::WebhookDestinationDelivery>]
+        def list_deliveries(
+          destination_uuid,
+          limit: OMIT,
+          offset: OMIT,
+          date_from: OMIT,
+          date_to: OMIT,
+          request_options: nil
+        )
+          @client.request(
+            :get,
+            "/v3/webhook/destinations/{destination_uuid}/deliveries/",
+            path_params: { "destination_uuid" => destination_uuid },
+            query: {
+              "limit" => limit,
+              "offset" => offset,
+              "date_from" => date_from,
+              "date_to" => date_to
+            },
+            page: Types::WebhookDestinationDelivery,
+            request_options: request_options
+          )
+        end
+
+        # Resend webhook destination delivery
+        #
+        # Send a past delivery again, for example after your endpoint was down. Didit takes the stored payload, sets a
+        # fresh `timestamp`, signs it again with the destination's current `secret_shared_key` (`X-Signature`,
+        # `X-Signature-V2`, `X-Signature-Simple` and `X-Timestamp`) and posts it to the delivery's `request_url`, even
+        # if the destination's URL has changed since or the destination is disabled. `event_id` and the rest of the
+        # payload are unchanged, so deduplicate on `event_id`. The call waits up to 5 seconds for your endpoint and
+        # returns the new delivery with `200` whatever your endpoint answered: read `response_status`. A resend is not
+        # retried automatically, every call sends again and creates a new delivery, and the request has no body. A
+        # scoped API key needs `webhooks: write` and `decisions: read`; a key limited to some workflows or to approved
+        # sessions cannot use this endpoint.
+        #
+        # +POST /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/resend/+
+        #
+        # @param destination_uuid [String] UUID of the destination the delivery was sent to.
+        # @param delivery_uuid [String] UUID of the delivery to resend: the `uuid` of an entry returned by `GET
+        #   /v3/webhook/destinations/{destination_uuid}/deliveries/`.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::WebhookDestinationDeliveryDetail]
+        def resend_delivery(destination_uuid, delivery_uuid, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/resend/",
+            path_params: { "destination_uuid" => destination_uuid, "delivery_uuid" => delivery_uuid },
+            response: Types::WebhookDestinationDeliveryDetail,
+            request_options: request_options
+          )
+        end
+
+        # Get webhook destination
+        #
+        # Retrieve one webhook destination with its `secret_shared_key` signing secret, its health (`health_status`,
+        # `failing_streak`, `failing_since`, `last_success_at`) and a delivery `summary` for the last 30 days. API-key
+        # callers always receive the secret in full; Console users without `read:webhooks` see an empty string.
+        #
+        # +GET /v3/webhook/destinations/{destination_uuid}/+
+        #
+        # @param destination_uuid [String] UUID of the destination (the `uuid` returned from create / list).
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::WebhooksDestinationsRetrieveResponse]
+        def retrieve(destination_uuid, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/webhook/destinations/{destination_uuid}/",
+            path_params: { "destination_uuid" => destination_uuid },
+            response: Types::WebhooksDestinationsRetrieveResponse,
+            request_options: request_options
+          )
+        end
+
+        # Get webhook destination analytics
+        #
+        # Delivery totals, failure rate and response times for one webhook destination, over the whole range
+        # (`summary`) and per UTC day (`points`). Every attempt counts as a delivery: the first send of an event, each
+        # automatic [retry](https://docs.didit.me/integration/webhooks#retry-policy) and each resend. A delivery is
+        # failed when its recorded HTTP status is 400 or above, so timeouts (recorded as `504`) and connection
+        # failures (`503`) count as failed; a delivery still queued counts in `total_deliveries` only. Delivery
+        # records are available for about 30 days. A scoped API key needs `webhooks: read`.
+        #
+        # +GET /v3/webhook/destinations/{destination_uuid}/analytics/+
+        #
+        # @param destination_uuid [String] UUID of the destination (the `uuid` returned by `GET
+        #   /v3/webhook/destinations/`).
+        # @param date_from [Date, String] First UTC day to include, as `YYYY-MM-DD` (inclusive). Omit to start from
+        #   the oldest delivery available. `dateFrom` is accepted as an alias.
+        # @param date_to [Date, String] Last UTC day to include, as `YYYY-MM-DD` (inclusive). Must not be earlier than
+        #   `date_from`. `dateTo` is accepted as an alias.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::WebhooksDestinationsRetrieveAnalyticsResponse]
+        def retrieve_analytics(destination_uuid, date_from: OMIT, date_to: OMIT, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/webhook/destinations/{destination_uuid}/analytics/",
+            path_params: { "destination_uuid" => destination_uuid },
+            query: {
+              "date_from" => date_from,
+              "date_to" => date_to
+            },
+            response: Types::WebhooksDestinationsRetrieveAnalyticsResponse,
+            request_options: request_options
+          )
+        end
+
+        # Get webhook destination delivery
+        #
+        # Retrieve one delivery attempt to a webhook destination with the exact request headers and JSON body Didit
+        # sent, the HTTP status your endpoint returned and the response time. `request_header` and `request_body` are
+        # JSON text: parse them to read the signature headers and the payload, for example to check your [signature
+        # verification](https://docs.didit.me/integration/webhooks#signature-verification) against the destination's
+        # `secret_shared_key`. A delivery never contains the signing secret, and Didit does not record your endpoint's
+        # response body. A scoped API key needs `webhooks: read` and `decisions: read`; a key limited to some
+        # workflows or to approved sessions cannot use this endpoint.
+        #
+        # +GET /v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/+
+        #
+        # @param destination_uuid [String] UUID of the destination the delivery was sent to.
+        # @param delivery_uuid [String] UUID of the delivery: the `uuid` of an entry returned by `GET
+        #   /v3/webhook/destinations/{destination_uuid}/deliveries/`.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::WebhookDestinationDeliveryDetail]
+        def retrieve_delivery(destination_uuid, delivery_uuid, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/webhook/destinations/{destination_uuid}/deliveries/{delivery_uuid}/",
+            path_params: { "destination_uuid" => destination_uuid, "delivery_uuid" => delivery_uuid },
+            response: Types::WebhookDestinationDeliveryDetail,
+            request_options: request_options
+          )
+        end
+
+        # Update webhook destination
+        #
+        # Update a webhook destination. **`subscribed_events` is REPLACED wholesale, not merged**: fetch first,
+        # append, resend. Secret is not rotated. A `uuid` in the body is ignored: the path names the destination.
+        #
+        # +PATCH /v3/webhook/destinations/{destination_uuid}/+
+        #
+        # @param destination_uuid [String] UUID of the destination to update.
+        # @param label [String] New human-readable name.
+        # @param url [String] New target URL. Must be unique within the application.
+        # @param enabled [Boolean] Set to `false` to pause deliveries to this destination without deleting it.
+        # @param webhook_version [String] New payload schema version for future deliveries.
+        # @param subscribed_events [Array<String>] Event filter for this webhook destination. Didit delivers only
+        #   webhooks whose event type exactly matches one of these values - there is no wildcard subscription. When
+        #   sent, the list must contain at least one valid event (an explicit `[]` is rejected with 400); a destination
+        #   whose list is empty (field omitted at create) receives nothing. On update the list is replaced wholesale,
+        #   never merged.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::WebhooksDestinationsUpdateResponse]
+        def update(
+          destination_uuid,
+          label: OMIT,
+          url: OMIT,
+          enabled: OMIT,
+          webhook_version: OMIT,
+          subscribed_events: OMIT,
+          request_options: nil
+        )
+          @client.request(
+            :patch,
+            "/v3/webhook/destinations/{destination_uuid}/",
+            path_params: { "destination_uuid" => destination_uuid },
+            body: {
+              "label" => label,
+              "url" => url,
+              "enabled" => enabled,
+              "webhook_version" => webhook_version,
+              "subscribed_events" => subscribed_events
+            },
+            response: Types::WebhooksDestinationsUpdateResponse,
+            request_options: request_options
+          )
+        end
+      end
+    end
+  end
+end