Receive a Stripe webhook
Where Stripe delivers events for one provider connection. You do not call this — you paste the URL into the webhook settings of the Stripe account you connected, and the connection id in the path is what tells us whose secret to verify the signature with.
It is outside /v1 on purpose. The version prefix is a promise about endpoints you call from your own code; this URL lives in a setting inside somebody else’s dashboard, and a new API version must never mean going and editing it.
The signature is the only credential. There is no token, and the connection id authorizes nothing on its own — a request that cannot produce a signature over the body with this connection’s webhook secret is refused, always. There is no mode in which an unverifiable body is accepted.
Retries are safe, and 202 is the answer either way. Every accepted event is recorded under the provider’s own event id for this connection, so a redelivery — a retry after a timeout, or a whole window replayed after an outage — takes effect exactly once and still answers 202. Nothing is applied inside this request: it is accepted, and processed immediately afterwards. That is also why a 202 does not mean the change is already visible on your other reads.
Out-of-order delivery is handled. Providers do not promise order, so an event is compared against the newest one already applied to the same object before it is acted on. An event that is older than what is known is accepted and deliberately not applied — which is what keeps a late customer.subscription.updated from resurrecting a subscription that was cancelled after it.
Parâmetros de caminho
The provider connection this endpoint belongs to. Each connection has its own webhook secret, so each gets its own URL.
Corpo
The provider's event, exactly as it was signed. It is read as bytes and never re-serialized — what is stored has to be what the signature covered.
A Stripe event object. Its shape is Stripe's, not ours.
Resposta
Accepted. The event is recorded and will be processed; a repeat of an event already recorded answers this too.