Checkout status changed
Delivered to every active endpoint on the tenant when a checkout moves status. queued does not fire — creation is synchronous and the caller already holds the object. Delivery is best-effort with a 10-second timeout and 3 retries, carries no event id and no ordering guarantee, so treat it as a doorbell and make the handler idempotent against the state you fetch.
Headers
t=<unix seconds>,v1=<hex>. v1 is HMAC-SHA256(secret, "<t>.<raw body>") with the endpoint's whsec_… secret. Verify against the raw request bytes, before any JSON parse.
Body
The body of a checkout.status_changed delivery. It says that something changed, not what the checkout now looks like: fetch GET /v1/checkouts/{checkoutId} for the state.
The only event type today. Switch on it anyway and ignore what you do not recognise.
"checkout.status_changed"succeeded, failed and cancelled are terminal; nothing leaves them.
queued, running, awaiting_user_action, succeeded, failed, cancelled Set only when status is failed.
max_cost_exceeded, user_cancelled, user_action_expired, automation_failed When the transition was dispatched, stamped once — a retried delivery carries the original event time.
Your own id for the end user this checkout is for. Absent when the checkout is not tagged to one.
An endpoint is tenant-wide — it receives every end user's transitions — so this is what lets a delivery be routed to the right person without a callback or a map of your own.
"user_a91f"
Response
Acknowledged. Return quickly and do the work out of band — anything slower than 10 seconds is treated as a failure and retried.