Skip to main content

Overview

Use this page to map webhook event types to payload shapes. The same PepayEvent envelope is used by WebSocket event_v1 frames.

Authentication

Webhook deliveries are signed. Validate X-Pepay-Timestamp and signature headers before parsing business logic payloads. See Webhook Authentication.

Request

Webhook endpoints receive POST requests with JSON payloads:

Response

Event envelope (shared)

All webhook deliveries use the canonical PepayEvent envelope. WebSocket event_v1 frames use the same shape, so you can reuse handlers across webhooks and WebSockets.
See WebSockets for the realtime stream that mirrors these event types.

Errors

  • 400 should be returned for invalid signature or invalid payload.
  • Non-2xx responses trigger retry delivery attempts.
  • Treat handlers as idempotent due at-least-once delivery semantics.

Examples

Event types (overview)

Invoice events

invoice.created

invoice.updated

Payment events

invoice_payment.created

invoice_payment.updated

Commerce order events

commerce.order.created

commerce.order.updated

Test event

test.ping

Tips for handlers

  • Treat invoice as the source of truth for payment state.
  • Dedupe by event.id (also sent as X-Pepay-Event-ID).
  • Keep handlers idempotent for at-least-once delivery.
Next: Webhook Authentication