Payout processed
PROCESSING → PROCESSED (settled).
Headers
t=<unix-timestamp>,v1=<hex-hmac>: a hex-encoded HMAC-SHA256 signature computed over
{timestamp}.{raw_body} (the exact bytes sent, not a re-serialized copy) using your organization's
signing secret for that environment. Reject if t is more than 300 seconds from now, then verify v1 with a
constant-time compare. See Webhook authentication. Dedup on the
delivered event's id, not on this header.
"t=1735689600,v1=5257a869e7bfbe00e0be2007c1b7be16bb2ba57ee233b0d0c4de5d83b3f5e01d"
Body
PROCESSING → PROCESSED (settled). PROCESSED → RETURNED can still follow later, on a post-settlement bank return.
The type of object represented, a fixed discriminator. Always "event" for this resource, and identical across every object of the type.
"event""event"
Event identifier, the client's dedup key for this delivery.
^evt_[1-9A-HJ-NP-Za-km-z]{21,22}$"evt_5EdynMEiYSyiWAH9GpcbHp"
Resource noun this event is about, the plural of the resource segment in eventType. Route coarsely on this; switch on eventType for the specific transition.
"payouts""payouts"
Product-namespaced lowercase {product}.{resource}.{action} event type, the product segment mirroring the resource's URL, the one lowercase-enum exception on this platform (every other enum is SCREAMING_SNAKE).
"payments.payout.processed""payments.payout.processed"
Event timestamp.
^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$"2026-06-04T10:30:00.000Z"
The Payout resource plus event-only context, embedded as data on every payments.payout.*
webhook/event.
Delivered as the payout reads over the API, except that a name-bearing confirmation entry carries no name strings.
Response
Return any 2xx to acknowledge receipt of the event.