Event catalog

The consumer subscribes only to the list below. The public type strips the gateway. or gateway.payment. prefix and the version. gateway.payment.charge.paid.v1 and gateway.payment.charge.paid.v2 become the same charge.paid. payout.completed comes from gateway.payout.completed.v2.

checkout_session.paid does not exist. Session types are checkout_session.created, checkout_session.completed, and checkout_session.expired.

The * filter can be stored on an endpoint, but it is not an emitted type. The internal prefix allowlist would accept other charge., checkout_session., subscription., invoice., customer., affiliate., refund., payout., and dispute. names if they reached the consumer. The consumer does not subscribe to those extras today. Document only the subscribed types, plus the webhook.test ping.

Subscribed types

• apikey.rotation_warning
• charge.cancelled
• charge.created
• charge.disputed
• charge.expired
• charge.failed
• charge.paid
• charge.partially_refunded
• charge.payment_failed
• charge.refunded
• charge.under_review
• charge.updated
• checkout_session.completed
• checkout_session.created
• checkout_session.expired
• dispute.lost
• dispute.opened
• dispute.won
• refund.completed
• refund.failed
• refund.requested
• refund.unknown
• payout.completed
• payout.failed
• subscription.activated
• subscription.canceled
• subscription.canceled_due_to_payment_failure
• subscription.card_updated
• subscription.created
• subscription.ended
• subscription.initial_payment_settled
• subscription.invoice.paid
• subscription.invoice.payment_failed
• subscription.past_due
• subscription.paused
• subscription.payment_failed
• subscription.payment_method_update_required
• subscription.payment_unknown
• subscription.plan_change_scheduled
• subscription.plan_changed
• subscription.reactivated
• subscription.recovered
• subscription.resumed
• subscription.retention_coupon_applied
• subscription.unpaid
• subscription.updated

Body

{"id":"<event id>","type":"charge.paid","data":{}}

data copies only allowlisted fields present on the source, or an explicit data object limited to the same allowlist. Properties outside that list are not forwarded. If merchant_id is missing, the consumer adds the event's merchant id. The registration ping is the exception: the body is exactly {"id":"webhook.test","type":"webhook.test","data":{"ping":true}}, and ping is a boolean.

For charge.*, charge_id aliases aggregate_id and amount_cents aliases gross_amount_cents when the public field is not already set. For payout.*, payout_id aliases aggregate_id and amount_cents aliases net_amount_cents. apikey.rotation_warning does not include secret.

Possible fields, with whatever type the source already carried (there is no single type per field; days_before has arrived as a string): aggregate_id, api_key_id, grace_until, days_before, amount_cents, attempt_number, cancelled_at, charge_id, checkout_session_id, coupon_id, currency, customer_id, discount_applied_cents, environment, fee_cents, from_status, invoice_id, invoice_sequence, merchant_id, net_amount_cents, next_billing_date, occurred_at, paid_at, paused_at, payment_link_id, payment_method, payout_id, payout_state, plan_id, product_id, reactivated_at, recorded_at, requested_amount_cents, resumed_at, status, subscription_id, to_status.

MuPag-Signature covers that raw JSON. X-Gateway-Event-Id and X-Gateway-Timestamp travel with the delivery, and X-Gateway-Signature repeats the HMAC-SHA256.