TrieOH
UniventsAPIWebhooks

Receive a Payssage webhook delivery

Ingestion endpoint called by Payssage when a payment event occurs on an intent. The body is the Payssage delivery envelope (D2) — the correlation key is `intent_id`, never a provider-specific id: ```json { "intent_id": "...", "wallet_id": "...", "provider": "mercadopago", "external_id": "<provider_payment_id>", "event_type": "payment.succeeded", "status_detail": "high_risk", "payload": { "...": "raw provider payload" } } ``` Authenticated by the `X-Payssage-Signature` header — hex (HMAC-SHA256(raw body, `PAYSSAGE_WEBHOOK_SECRET`)). A signature mismatch is rejected with 400 (Payssage does not retry). Returns 200 after successful processing so Payssage stops retrying; returns non-2xx when the purchase cannot be correlated yet (card race, D3) so Payssage retries. This is the only component that confirms payment — checkout never self-approves (D3). Public: Payssage cannot send an Authorization header.

POST/webhooks/payssage

Ingestion endpoint called by Payssage when a payment event occurs on an intent. The body is the Payssage delivery envelope (D2) — the correlation key is intent_id, never a provider-specific id:

{
  "intent_id": "...", "wallet_id": "...", "provider": "mercadopago",
  "external_id": "<provider_payment_id>",
  "event_type": "payment.succeeded",
  "status_detail": "high_risk",
  "payload": { "...": "raw provider payload" }
}

Authenticated by the X-Payssage-Signature header — hex (HMAC-SHA256(raw body, PAYSSAGE_WEBHOOK_SECRET)). A signature mismatch is rejected with 400 (Payssage does not retry). Returns 200 after successful processing so Payssage stops retrying; returns non-2xx when the purchase cannot be correlated yet (card race, D3) so Payssage retries. This is the only component that confirms payment — checkout never self-approves (D3). Public: Payssage cannot send an Authorization header.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

The Payssage webhook delivery envelope (D2). Correlation is by intent_id — the receiver loads the purchase on it, never on a provider-specific id. Every field is required: a malformed body is rejected with 400 and payssage does not retry.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/webhooks/payssage" \  -H "Content-Type: application/json" \  -d '{    "intent_id": "05704cef-194d-4987-b2cb-c2c20c9cd88a",    "wallet_id": "d9a8fbfc-848f-43a2-9168-911ed3a04a48",    "provider": "string",    "external_id": "string",    "event_type": "string",    "payload": {}  }'
{
  "code": 0,
  "message": "string",
  "data": {},
  "error": {
    "code": "BAD_REQUEST",
    "message": "string",
    "fields": [
      {
        "field": "string",
        "message": "string"
      }
    ],
    "meta": {},
    "debug": {
      "raw_error": "string",
      "stack_trace": "string"
    }
  },
  "pagination": {
    "page": 1,
    "limit": 1,
    "total": 0,
    "has_next": true,
    "has_prev": true,
    "next_page": 0,
    "prev_page": 0
  },
  "timestamp": "2019-08-24T14:15:22Z",
  "module": "string"
}
{
  "code": 0,
  "message": "string",
  "error": {
    "code": "BAD_REQUEST",
    "message": "string",
    "fields": [
      {
        "field": "string",
        "message": "string"
      }
    ],
    "meta": {},
    "debug": {
      "raw_error": "string",
      "stack_trace": "string"
    }
  },
  "timestamp": "2019-08-24T14:15:22Z",
  "module": "string"
}
{
  "code": 0,
  "message": "string",
  "error": {
    "code": "BAD_REQUEST",
    "message": "string",
    "fields": [
      {
        "field": "string",
        "message": "string"
      }
    ],
    "meta": {},
    "debug": {
      "raw_error": "string",
      "stack_trace": "string"
    }
  },
  "timestamp": "2019-08-24T14:15:22Z",
  "module": "string"
}

List an edition's emission errors GET

Lists the certification emission errors recorded for the edition (attendees whose certificates failed to emit). The actor must be an owner or admin of the event.

List my purchases GET

Lists the authenticated user's purchases with their items, newest first. The purchases table is the record of truth (issue #61); items come from `purchase_items` — the availability ledger (D4). Read-only; no state transitions.