Webhooks

{
  "data": {
    "type": "transaction_updated",
    "id": "pt_ABC123",
    "status": "paid",
    "settlement_status": "paid",
    "amount": {
      "value": 1000,
      "currency": "USD"
    },
    "settlement_amount": 1000,
    "settlement_currency": "USDC",
    "settlement_fee": 25,
    "amount_paid": 1000,
    "amount_received": 1000,
    "amount_remaining": 0,
    "history": [
      {
        "time": 1714124827333,
        "status": "success",
        "description": "Payment created"
      },
      {
        "time": 1714124900000,
        "status": "success",
        "description": "Customer paid"
      }
    ],
    "metadata": {}
  }
}

const crypto = require('crypto');
const express = require('express');
const app = express();

// Capture the raw body for the webhook route (do NOT use express.json() here).
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-auth'];
  const rawBody = req.body; // Buffer — the exact bytes Ebioro signed

  const expected = crypto
    .createHmac('sha256', YOUR_API_SECRET_KEY)
    .update(rawBody)
    .digest('hex');

  const valid =
    signature &&
    expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));

  if (!valid) {
    return res.status(401).send('Invalid signature');
  }

  const { type, status, id } = JSON.parse(rawBody.toString()).data;
  // Process the webhook...

  res.status(200).send('OK');
});

# Find failed deliveries for a payment
GET /merchants/{merchantId}/webhook-logs?status=failed&checkout_id=pt_ABC123

# Inspect one delivery — includes the exact payload sent and your endpoint's response
GET /merchants/{merchantId}/webhook-logs/{id}

# Replay it to your endpoint
POST /merchants/{merchantId}/webhook-logs/{id}/resend