custody.deposit.retracted
A chain reorg undid a deposit that custody.deposit.final reported, and the platform took its value back from the participant's free balance. amount is in the asset's base units and assetKey names the custody asset. supersedes names the custody.deposit.final event when this endpoint received it.
Delivery contract
| Field | Value |
|---|---|
| Event type | custody.deposit.retracted |
| Version | 1 |
| Lifecycle state | retracted |
| Counter-signed receipts | No event-specific advice |
| SDK type | Webhook.CustodyDepositRetractedV1 |
The receipt recommendation does not change delivery behavior. DALP waits for a counter-signed receipt only if the webhook endpoint's counterSignedReceipts value is true when DALP queues the delivery. When the value is false, a normal 2xx response completes the delivery.
Related references:
depositIdjournalEntryId
Handle the retraction
Verify the delivery before processing it. When supersedes names an event you stored, use it to find the earlier event. It is absent when this endpoint was never sent that event, and it can name an event you never stored when that delivery did not succeed; then match the retraction by the payload identifiers instead. Mark that event as retracted, then reconcile or reverse the downstream changes it created. Deduplicate by evt_id so retries do not repeat this work.
If the retraction arrives first, retain it and prevent the earlier event from taking effect if it arrives later. Keep both events in your audit record. A retraction does not request a new ledger transaction.
See webhook idempotency and on-chain outcome for retry, replay, and lifecycle handling.
Payload schema
The schema and examples describe the full payload. Thin delivery omits personal data fields. Use the payload-shape guidance to choose the endpoint configuration.
{
"type": "object",
"properties": {
"chainId": {
"type": "integer",
"exclusiveMinimum": 0
},
"depositId": {
"type": "string",
"minLength": 1
},
"transactionHash": {
"type": "string",
"pattern": "^0x[a-fA-F0-9]{64}$"
},
"logIndex": {
"type": "integer",
"minimum": 0
},
"assetKey": {
"type": "string",
"minLength": 1
},
"walletId": {
"type": "string",
"minLength": 1
},
"participantId": {
"type": "string",
"minLength": 1
},
"amount": {
"type": "string",
"pattern": "^(?:0|[1-9]\\d{0,77})$"
},
"journalEntryId": {
"type": "string",
"minLength": 1
},
"occurredAt": {
"type": "string"
},
"reason": {
"type": "string",
"enum": ["reorged"]
},
"supersedes": {
"type": "string",
"pattern": "^evt_[a-zA-Z0-9]+$"
}
},
"required": [
"chainId",
"depositId",
"transactionHash",
"logIndex",
"assetKey",
"walletId",
"participantId",
"amount",
"journalEntryId",
"occurredAt",
"reason"
],
"additionalProperties": true
}TypeScript SDK example
Use the request's raw body and headers with your endpoint's webhook secret. This handler illustrates verification and event selection. Before writing downstream state, deduplicate deliveries by evt_id and recognize replayed outcomes by their domain identifiers.
const result = await verifyWebhook({
rawBody,
headers,
secret: process.env.DALP_WEBHOOK_SECRET!,
});
if (!result.ok) {
throw new Error(`Webhook verification failed: ${result.code}`);
}
if (result.event.type === "custody.deposit.retracted") {
const event: Webhook.Event<"custody.deposit.retracted"> = result.event;
console.log(event.payload);
}HTTP delivery example
This illustrative request shows the delivery shape. Its timestamp and signature are placeholders; a verifier rejects them. Use a signed platform delivery to verify your endpoint.
curl -X POST https://consumer.example.com/dalp/webhooks \
-H "content-type: application/json" \
-H "webhook-id: evt_937853dc54b4c60d1f0f4e79582d04dc" \
-H "webhook-timestamp: 1778112000" \
-H "webhook-signature: v1,docs-example-signature" \
--data '{"evt_id":"evt_937853dc54b4c60d1f0f4e79582d04dc","source_id":"example:custody.deposit.retracted@1:0","lifecycle_state":"retracted","supersedes":"evt_custodydeposit001","payload":{"chainId":537001,"depositId":"537001:0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc:4","transactionHash":"0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","logIndex":4,"assetKey":"usdc","walletId":"wal_01J9ZQ8D1F3H5K7M9P1R3T5V7X","participantId":"ptc_01J9ZQ8E2G4J6L8N0Q2S4U6W8Y","amount":"2500000000","journalEntryId":"jrn_01J9ZQ8G4J6L8N0Q2S4U6W8Y0B","occurredAt":"2026-09-28T09:41:12.208Z","reason":"reorged","supersedes":"evt_custodydeposit001"},"related":{"depositId":"depositId_example","journalEntryId":"journalEntryId_example"},"type":"custody.deposit.retracted","version":1,"request":{"idempotency_key":"idem_01JZP7R5W8M9N0P1Q2R3S4T5"}}'Version and manifest
This page documents version 1 of custody.deposit.retracted. This event type is not deprecated. The DALP events manifest contains the machine-readable AsyncAPI entry.
custody.deposit.final
A custodial deposit reached a participant's free balance, so the participant can spend it. Sent when the deposit credits the free balance directly, or when screening and finality clear a held deposit. A deposit held for screening or finality sends nothing until it clears. amount is in the asset's base units and assetKey names the custody asset. A later custody.deposit.retracted names a deposit a chain reorg undid.
custody.signer-changed.final
A signer was added to or removed from a System smart account's validator, a signer's weight or the validator's threshold changed, or its owner was replaced; sent once the chain finality watermark reaches its source block. Identifies signers only by the keccak-256 hash of their signer bytes, never by key material.