Malaleem API

Transfer webhooks

Same envelope and signature as payment events — `{id, type, created, data}` with `X-Malaleem-Signature: t=<unix>,v1=<hex HMAC-SHA256(webhook_secret, "<t>.<raw body>")>` and `X-Malaleem-Event: <type>` — where `data` is the transfer object. `transfer.succeeded` and `transfer.failed` go to the sending key's webhook URL (`data.direction` = sent). `transfer.received` goes to every active key of the recipient, in the transfer's mode, that has a webhook URL, each signed with that key's own webhook secret (`data.direction` = received, `data.metadata` = {}). A test transfer notifies test keys only, a live one live keys only.