Webhook operations

Vendorzo receives callbacks from configured payment and fulfillment providers. The exact endpoint, event set, signature scheme, and retry policy are provider-specific and can change between releases. Use the provider's official setup instructions and current Vendorzo helper text. Confirm the exact callback URL, signing secret, and environment with the installation owner; do not guess an endpoint from another integration.

Before enabling live callbacks:

1. Configure the provider's exact HTTPS callback URL from the integration setup.
2. Set the correct signing secret and environment/mode on both sides.
3. Send a provider test event and verify the response and resulting Vendorzo record.
4. Confirm duplicate delivery does not repeat payment, shipment, or settlement effects.
5. Monitor signature failures and unknown outcomes; reconcile with the provider before retrying any side-effecting action.

Do not disable signature verification to make a callback pass. Rotate a leaked secret at the provider and in Vendorzo, then replay only events the provider documents as safe to retry.