Skip to main content
WEBHOOK

Headers

​
x-hmac-signature
string
required

HMAC-SHA256 signature of the raw request body, computed with the webhook's hmac_key and encoded as lowercase hex. Verify it to authenticate the delivery.

Body

application/json

Body delivered to your registered URL when a subscribed event occurs.

​
id
string<uuid>
required

Unique identifier for this event.

​
event
enum<string>
required

The decision event that triggered the notification. decision.async.* variants are emitted when an asynchronous (backend) evaluation completes after a PROVISIONAL response.

Available options:
decision.allow,
decision.block,
decision.review,
decision.provisional,
decision.async.allow,
decision.async.block,
decision.async.review
​
decision_id
string<uuid>
required

The decision this event relates to.

​
occurred_at
string<date-time>
required

ISO 8601 timestamp when the event occurred.

​
payment_state
enum<string> | null

Payment lifecycle state at the time of the event. Present only for asynchronous decision events (decision.async.*). "fraud_reported" is a legacy value no longer written — fraud is tracked by the fraud marker fields, independent of payment_state.

Available options:
authorized,
captured,
voided,
fraud_reported,
chargedback,
failed
Example:

"captured"

Response

Acknowledged. Any 2xx status code marks the delivery successful.