Paymentrefunded
Sent when a refund created through this API succeeds (full or
partial). Same delivery, signature, and retry contract as
payment.completed.
Authorizations
Merchant API key (fp_live_* for live, fp_test_* for sandbox) or an
admin-tier JWT (company admin or root admin). Non-admin JWTs are
rejected with 403; live API keys additionally require the merchant's
API access to be enabled.
Body
Payload POSTed to the merchant's configured webhook URL when a payment
transitions to a terminal state. Deliveries are signed: the
X-Fluid-Signature header carries the hex HMAC-SHA256 of the raw JSON
body, keyed with the merchant's webhook secret, and X-Fluid-Event
carries the event name. Delivery is at-least-once (up to 5 retries with
exponential backoff on connection failures, timeouts, and 5xx
responses; 10-second timeout), so receivers must tolerate duplicates.
Webhooks fire only for transactions created by API-key-authenticated
requests, and only when the merchant has both a webhook URL and a
webhook secret configured. The destination must be a public HTTPS URL:
a delivery that fails outbound-safety validation at any point — a
non-HTTPS scheme, a private or internal host, an unresolvable
hostname, too many redirects, or any other unsafe-URL condition — is
skipped entirely and never retried.
Event name. payment.completed fires for a successful purchase or
authorization; payment.captured, payment.voided, and
payment.refunded fire for successful captures, voids, and
refunds; payment.declined and payment.error fire when any of
those operations is declined by the provider or fails processing.
Verifications never emit webhooks.
payment.completed, payment.declined, payment.error, payment.voided, payment.refunded, payment.captured ISO 8601 timestamp (UTC) of when the event was emitted.
Snapshot of the transaction the event describes.
Response
Return any 2xx status to acknowledge receipt. 5xx responses, connection failures, and timeouts are retried up to 5 times with exponential backoff; 4xx responses are logged and not retried.