Version

payment.* events

Payment lifecycle: succeeded, failed, pending, refunded.

Payment lifecycle: succeeded, failed, pending, refunded. payment.succeeded and payment.failed are emitted by the provider webhook listeners, which all funnel through the same shared listener so their shapes stay consistent. payment.pending is emitted earlier, by the per-provider checkout-initiation actions, and its shape varies by provider. payment.refunded is emitted by a single shared refund action. Not every provider emits every event; see the per-event sections.

Background

Example envelope

{
  "id": "evt_01HX...",
  "type": "payment.succeeded",
  "created_at": "2026-05-18T10:05:00Z",
  "api_version": "2026-05-01",
  "project_id": "7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13",
  "data": {
    "subscription_id": "5b7e2d40-1a86-4c39-97f2-e83d0b16c5a4",
    "plan_id": "c4e82f16-93a7-4d5b-b81c-6e0f27a94d3b",
    "subscriber_id": "2a91c4e7-6f38-4b52-8e0d-9c1a7b3f5d80",
    "provider": "stripe",
    "external_payment_id": "pi_3Nxy..",
    "amount": "29.00",
    "currency": "USD",
    "billing_reason": "subscription_create"
  }
}

What you don't get

  • Card numbers / PAN / CVV. Any provider-specific credentials are stripped.
  • Stripe raw webhook payloads. Use Stripe's own webhooks if you need provider internals.
  • Merchant fee breakdowns. Those are an internal accounting concern surfaced only in the Subscriby dashboard.

Required ability

Tokens subscribing to payment.* events must carry project-subscription:view at mint time.

Events

payment.succeeded

WEBHOOK

A provider confirms a successful charge.

When this fires

A payment provider confirms a successful charge against a subscriber. Fires for both initial checkouts and recurring renewals.

Caveats

  • For first-time paid checkouts, subscription.activated is the matching subscription-level event, not subscription.created, which never fires for paid purchases.
  • Renewals pair payment.succeeded with subscription.renewed.
  • Card numbers, PAN, and CVV are never included in payloads.

Related events

  • subscription.activated (first payment), subscription.renewed (renewals): paired subscription events.
  • payment.failed: alternative outcome.

Ability to subscribe

A token needs this to subscribe an endpoint to the event.

Header Parameters

SB-Signature*string

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Id*string

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Name*string

The event name, the same as the envelope's type.

Content-Type*string

Always application/json.

User-Agent*string

Always Subscriby-Webhooks/1.0.

Payload

JSONWhat Subscriby posts to your endpoint

The signed JSON envelope posted to your endpoint.

The envelope every event is delivered in.

Responses

2XXAny success status

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

defaultAny other status

Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.

payment.failed

WEBHOOK

A provider rejects a charge.

When this fires

A payment provider rejects a charge: invalid card, insufficient funds, gateway risk, expired source. Emitted by Stripe, CeyPay, CoinPayments, Paystack, Razorpay and Skrill. PayPal does not emit payment.failed; a failed PayPal charge surfaces only through the subscription-level events.

Caveats

  • The paired subscription event differs by provider: Razorpay emits subscription.past_due alongside; CeyPay, CoinPayments and Skrill instead cancel the subscription and emit subscription.cancelled; Paystack emits nothing alongside; for Stripe, subscription.past_due arrives separately when Stripe next syncs the subscription's status. Do not assume a subscription event accompanies every payment.failed.
  • A single billing cycle can produce multiple payment.failed events as the provider retries.

Related events

  • payment.succeeded: alternative outcome.
  • subscription.past_due: paired subscription event for recurring failures.

Ability to subscribe

A token needs this to subscribe an endpoint to the event.

Header Parameters

SB-Signature*string

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Id*string

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Name*string

The event name, the same as the envelope's type.

Content-Type*string

Always application/json.

User-Agent*string

Always Subscriby-Webhooks/1.0.

Payload

JSONWhat Subscriby posts to your endpoint

The signed JSON envelope posted to your endpoint.

The envelope every event is delivered in.

Responses

2XXAny success status

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

defaultAny other status

Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.

payment.pending

WEBHOOK

A payment is initiated, awaiting provider confirmation.

When this fires

A subscriber initiates checkout and is redirected to the provider, but the charge is not yet confirmed (bank transfer, crypto settlement, hosted-checkout sessions).

PayPal carries neither session_id nor order_id: a PayPal payment.pending gives you only provider, plan_id, and subscriber_id, so it cannot be correlated to a specific checkout attempt. Absent keys are omitted entirely rather than sent as null; the one exception is Stripe's session_id, which is always present on the Stripe path but may be null.

Caveats

  • A pending payment is not yet a subscription. subscription_id is intentionally absent.
  • The same checkout may emit one payment.pending followed by either payment.succeeded or payment.failed. Correlate on session_id or order_id where the provider supplies one; for PayPal, fall back to subscriber_id plus plan_id.
  • Subscribers who close the provider page without completing will not produce a final outcome event; pending sessions can hang indefinitely.

Related events

  • payment.succeeded, payment.failed: terminal outcomes.
  • subscription.activated: fires alongside the payment.succeeded that completes a first checkout.

Ability to subscribe

A token needs this to subscribe an endpoint to the event.

Header Parameters

SB-Signature*string

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Id*string

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Name*string

The event name, the same as the envelope's type.

Content-Type*string

Always application/json.

User-Agent*string

Always Subscriby-Webhooks/1.0.

Payload

JSONWhat Subscriby posts to your endpoint

The signed JSON envelope posted to your endpoint.

The envelope every event is delivered in.

Responses

2XXAny success status

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

defaultAny other status

Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.

payment.refunded

WEBHOOK

A specific charge is refunded, fully or partially.

When this fires

A per-payment refund settles. Pairs with subscription.refunded when the refund covers the entire subscription.

Settled refunds only. A refund a provider has queued but not yet paid out raises nothing; access is never revoked for money that has not actually moved.

Caveats

  • Emitted by Stripe, PayPal, Paystack, Razorpay and Skrill. CoinPayments and CeyPay expose no refund notification.
  • Raised for partial refunds as well as full ones. Read full_refund to tell them apart; a partial refund leaves the subscription and its access untouched.
  • Stripe reports a running total across refunds; the amount here is this refund, not the cumulative figure.
  • Distinct from subscription.refunded, which represents the subscription's reaction. A refund may emit only payment.refunded if the subscription itself is unaffected.
  • Partial refunds are represented by amount being less than the original charge.

Related events

  • payment.succeeded: predecessor.
  • subscription.refunded: subscription-level analogue.

Ability to subscribe

A token needs this to subscribe an endpoint to the event.

Header Parameters

SB-Signature*string

t=<unix seconds>,v1=<hex>: the HMAC-SHA256 of "<t>.<raw body>" under the endpoint's secret. Verify it before acting, and refuse a t more than 300 seconds from now. During a secret rotation a v0= signature under the previous secret may precede v1=.

SB-Event-Id*string

The event's ULID, bare. The envelope's id is the same ULID prefixed evt_, so strip the prefix before comparing. Deduplicate on it: a retry carries the same id.

SB-Event-Name*string

The event name, the same as the envelope's type.

Content-Type*string

Always application/json.

User-Agent*string

Always Subscriby-Webhooks/1.0.

Payload

JSONWhat Subscriby posts to your endpoint

The signed JSON envelope posted to your endpoint.

The envelope every event is delivered in.

Responses

2XXAny success status

Your endpoint acknowledged the delivery. Any 2xx status within 30 seconds marks it delivered; the response body is ignored.

defaultAny other status

Any other status, a connection failure, or no answer within 30 seconds counts as a failed attempt. The delivery is retried 8 times, after 10 seconds, 30 seconds, 2 minutes, 10 minutes, 1 hour, 6 hours, 1 day, 3 days; the last failure dead-letters it, and it can be retried from the dashboard or POST /v1/webhook-deliveries/{delivery}/retry. After 20 consecutive failures the endpoint is paused until it is resumed.

How is this guide?

Version

On this page

Subscriby is a product
designed by you — for you.
No boardroom full of executives deciding what we ships next. Our roadmap always shaped by you with your feedback.

Share feedback or a request