# payment.created

Webhook event `payment.created`, sent as `POST` to the URL of each webhook subscriber that subscribes to it.

Sent when a payment is created.

This describes webhook payload version 2. Version 1 sends the same envelope, with `data` in the shape of the object's retrieve endpoint; the Webhooks guide explains both.

## Request

### Header parameters

- `X-Webhook-HMAC` (string, required): The HMAC-SHA256 of the raw request body, keyed with the subscriber's shared secret, as a hex string. Verify it before trusting the body.
- `X-Webhook-Id` (string, required): The ID of the delivery. It stays the same when the delivery is retried.
- `X-Webhook-Attempt` (integer, required): Which attempt this is, starting at 1. Minimum 1.

## Payload

Content type `application/json`, required.

Type: object.

- `profile` (string, required): The ID of the webhook subscriber the delivery is for. Use it to choose the shared secret that verifies the signature.
- `merchantId` (string, required): The ID of your merchant account.
- `eventId` (string, required): The ID of the event. It is the same for every delivery of the event, so use it to skip duplicates.
- `eventType` (string, required): One of `payment.created`.
- `timestamp` (string (date-time), required): When the event happened.
- `data` (object (PaymentWebhookSnapshot) or object (WebhookSubjectReference), required): The payment as the event left it. Rarely, when the event could not be captured at that moment, `data` is read when the webhook is built instead, or contains only `id` if the payment no longer exists.
  - When the value is PaymentWebhookSnapshot:
    - `id` (string, required): The ID of the object.
    - `createdAt` (string (date-time), required): When the object was created.
    - `updatedAt` (string (date-time), required, nullable): When the object was last updated.
    - `status` (string, required): One of `open`, `requires_action`, `succeeded`, `cancelled`.
    - `amount` (integer, required): The amount, in the smallest unit of the currency. Minimum -9007199254740991. Maximum 9007199254740991.
    - `currency` (string, required): One of `usd`, `eur`, `gbp`, `cad`, `aud`, `pln`, `czk`, `sek`, `dkk`.
    - `amountCaptured` (integer, required): The amount captured so far. Minimum -9007199254740991. Maximum 9007199254740991.
    - `amountReversed` (integer, required): The amount refunded or voided so far. Minimum -9007199254740991. Maximum 9007199254740991.
    - `initiator` (string, required): One of `customer`, `merchant`.
    - `offSessionType` (string, required, nullable): One of `recurring`, `unscheduled`.
    - `captureMethod` (string, required, nullable): How the payment is captured. One of `automatic`, `automaticDelayed`, `manual`.
    - `captureAt` (string (date-time), required, nullable): When a delayed capture is scheduled.
    - `authorizedAt` (string (date-time), required, nullable)
    - `capturedAt` (string (date-time), required, nullable)
    - `reversedAt` (string (date-time), required, nullable)
    - `chargebackRecordedAt` (string (date-time), required, nullable)
    - `cancellationReason` (string, required, nullable)
    - `latestTransaction` (string, required, nullable): The ID of the latest transaction. Retrieve it from the API for the full object.
    - `latestDeclineType` (string, required, nullable): One of `soft_decline`, `hard_decline`, `not_attempted`.
    - `latestDeclineCode` (string, required, nullable): One of `internal_error`, `not_supported`, `generic_decline`, `insufficient_funds`, `authentication_failed`, `authentication_cancelled`, `authentication_unavailable`, `cancelled`, `invalid_card_details`, `expired_card`, `authentication_required`, `transaction_not_permitted`, `generic_issuer_error`, `generic_processor_error`, `processor_rate_limited`, `processor_timeout`, `fraud_suspected`, `card_restricted`, `authentication_rejected`, `payment_method_unusable`, `generic_hard_decline`, `already_captured`, `merchant_account_restricted`, `merchant_configuration_error`, `invalid_request`, `blocked_by_policy`, `order_not_permitted`, `stored_credential_revoked`.
    - `latestMessage` (string, required, nullable)
    - `customer` (string, required, nullable): The ID of the customer. Retrieve it from the API for the full object.
    - `paymentMethod` (string, required, nullable): The ID of the payment method. Retrieve it from the API for the full object.
    - `action` (object, required, nullable): The action the customer must take, such as a 3D Secure challenge, or `null`.
      - `redirectUrl` (string, required): Where to send the customer to complete the action.
    - `metadata` (object, required, nullable): Your metadata on the object, after the change that caused the event.
  - When the value is WebhookSubjectReference:
    - `id` (string, required): The ID of the object.

## Your response

### `2XX`

Acknowledges the delivery. Respond within 15 seconds; any other response, or none, is retried.


---

Generated from the Core API v2 OpenAPI document, https://api.odus.com/openapi.v2.json. Interactive page: https://docs.odus.com/docs/api/core/v2/webhook-payment-created