Request Chargeback Export

Initiates the asynchronous generation of a chargeback export file.

Upon receiving the request, the system immediately returns a 200 OK response with a unique id. Once the file has been generated and stored, Kushki sends a POST notification to each URL configured in the webhooks array, including the download link and its expiration timestamp.

The request body follows the same structure as POST /data/v1/chargebacks/search, with the addition of the webhooks field.

Note: The download URL is an S3 pre-signed URL valid for 4 hours from the moment of generation. Check expiration_timestamp in the webhook notification before attempting the download.

Webhook security

To verify that a notification was sent by Kushki and not a third party, validate the following headers included in every webhook call:

Header	Description
`X-Kushki-Id`	Unix timestamp (13 digits, milliseconds) of when the notification was sent.
`X-Kushki-Signature`	HMAC SHA256 signature of `private-merchant-id\|request\|X-Kushki-Id`. The signing secret is the merchant's own `private-merchant-id`.

To validate the signature on your side, compute:

HMAC-SHA256({private-merchant-id}, "{private-merchant-id}|{request}|{X-Kushki-Id}")

And compare the result with the value received in X-Kushki-Signature. If they match, the notification is authentic.

application/json

The export request was accepted. Kushki generates the file asynchronously and POSTs the download link to each URL in webhooks when it is ready.

Bodyapplication/json

curl --location 'https://api-uat.kushkipagos.com/data/v1/chargebacks/export' \ --header 'private-merchant-id;' \ --header 'Content-Type: application/json' \ --data '{ "filters": { "time": { "request_date": { "from": "2026-01-15", "to": "2026-03-15" } } }, "webhooks": [ "https://yoursite.com/webhooks/chargebacks" ] }'

Webhook security#

Request

Responses

Webhook security