2xx fast, dedupes by top-level event id, offloads slow reconciliation, ignores redelivery,
and changes business state only on confirmed events. When the webhook has a Security Token,
verify X-Pagou-Timestamp and X-Pagou-Signature before you trust the body, and still reconcile
the resource with GET. Webhooks with no Security Token, and notify_url postbacks, are unsigned.
The check is in Verifying signatures. A runnable
TypeScript check is in the
webhooks example.
Guide: Webhooks Overview · Payment events ·
Subscription events · Transfer events ·
Retries & reconciliation
Webhook delivery is inbound, so there is no OpenAPI operation to reference.