← Back to docs

Webhooks

Signed, deduplicated events are your source of truth for asynchronous rails.

Baraka Pay signs every webhook and delivers it with retries and backoff. Validate the signature, deduplicate by event id, and make your handler idempotent.

Payment success, failure, pending, cancellation and expiry are all delivered as events. Never fulfil on a browser redirect alone.

Events

Payments: payment.succeeded, payment.failed, payment.pending, payment.cancelled, payment.expired — plus delivery diagnostics you can replay from the Merchant portal.

Payouts: payout.pending, payout.approved, payout.processing, payout.succeeded, payout.failed, payout.cancelled, payout.returned. Note that payout.returned can arrive days after you were told the payout succeeded — see Payouts.

Cash deposits: cash_deposit.confirmed, raised once money is recognised against the bank's own record.

Every one of them carries the id of the thing that changed and nothing more. A webhook says WHICH record changed; the API says what it changed to, and only the API is authoritative.