Overview
Use this page to map webhook event types to payload shapes. The samePepayEvent envelope is used by WebSocket event_v1 frames.
Authentication
Webhook deliveries are signed. ValidateX-Pepay-Timestamp and signature headers before parsing business logic payloads.
See Webhook Authentication.
Request
Webhook endpoints receivePOST requests with JSON payloads:
Response
Event envelope (shared)
All webhook deliveries use the canonicalPepayEvent envelope. WebSocket event_v1 frames use the same shape, so you can reuse handlers across webhooks and WebSockets.
Errors
400should be returned for invalid signature or invalid payload.- Non-2xx responses trigger retry delivery attempts.
- Treat handlers as idempotent due at-least-once delivery semantics.
Examples
Event types (overview)
| Category | Event types | Description |
|---|---|---|
| Invoice lifecycle | invoice.created, invoice.updated | Invoice state changes (source of truth for payments). |
| Payment lifecycle | invoice_payment.created, invoice_payment.updated | Individual payment attempts and settlement status. |
| Commerce orders | commerce.order.created, commerce.order.updated | Order lifecycle updates (includes linked invoice/payment context when applicable). |
| Test deliveries | test.ping | Test event sent from the dashboard. |
Invoice events
invoice.created
invoice.updated
Payment events
invoice_payment.created
invoice_payment.updated
Commerce order events
commerce.order.created
commerce.order.updated
Test event
test.ping
Tips for handlers
- Treat
invoiceas the source of truth for payment state. - Dedupe by
event.id(also sent asX-Pepay-Event-ID). - Keep handlers idempotent for at-least-once delivery.

