POST to the link’s callbackUrl, with a JSON body. Respond with any 2xx within 10 seconds; anything else is retried. See Webhooks for retries, duplicates and signature checks.
Headers
string
required
t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>. Verify it before trusting the body.string
required
The event’s id, the same as the body’s
id. Repeats on retries and resends: use it to skip duplicates.string
required
The same as the body’s
type, e.g. order.settled.Body
string (uuid)
required
The event id.
string
required
One of
order.settled, order.overpaid, order.expired, order.expired_underpaid, order.manual_review, order.refunded.string (date-time)
required
When the order changed status.
object
required