> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rigaly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Provision a digital reward you implement this

> **Rigaly calls you.** This is the endpoint you host at
`digital_webhook_url` for a reward whose `digital_asset_source` is
`external`. It is called once per redemption, at redemption time, and
must return the value the customer receives.

Headers on every call:

| Header | |
|---|---|
| `X-Rigaly-Event` | Always `reward.provision` |
| `X-Rigaly-Timestamp` | Unix seconds |
| `X-Rigaly-Signature` | `t=<unix>,v1=<hex>` where the hex is `HMAC_SHA256(secret, "{t}.{raw body}")` |
| `Idempotency-Key` | The redemption's UUID (`test_<uuid>` for test calls) |
| `User-Agent` | `Rigaly-Webhooks/1.0` |

**The same `Idempotency-Key` must return the same value.** Store the key
with the value you minted and replay it on a repeat call — never mint a
new one. This is what makes the call safe to repeat.

Operational envelope: HTTPS only, redirects are not followed, 5 second
timeout, no in-request retries, response body capped at 64 KB, and a
per-reward circuit breaker that stops calling for 60 seconds after 5
consecutive failures. Anything other than a 2xx with a valid body fails
the redemption with `DIGITAL_PROVISION_FAILED` (502) — and because points
are only deducted **after** the value is secured, the customer is left
untouched: no points taken, no fee charged.

Full walkthrough with signature verification in four languages:
[external provisioning](/guides/reward-delivery#external-provisioning).




## OpenAPI

````yaml /openapi/v1.yaml webhook reward.provision
openapi: 3.1.0
info:
  title: Rigaly Business API
  version: '1.0'
  description: |
    Public API for businesses to manage their Rigaly loyalty programs: issue
    and redeem points, manage rewards, validate redemptions, and generate mass
    codes for physical products.

    All endpoints require an API key created in the Rigaly business dashboard
    (Tools → API Management), passed as `Authorization: Bearer rgly_sk_...`.
  contact:
    email: support@rigaly.com
servers:
  - url: https://api.rigaly.com
    description: Production
security:
  - apiKey: []
paths: {}
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      description: 'API key from the Rigaly dashboard: `Authorization: Bearer rgly_sk_...`'

````