An order's money came back to the wallet

webhook

order.refunded

Fires when an order is refunded. data.status is always refunded. Either a delivered order was
refunded and your wallet's available balance credited by the order total, less any cashback share the
order had paid you — taken back in the same transaction, since the refund undid the sale that earned
it — or the purchase was refunded before it was delivered and its reservation released. data.refund
says which amounts moved, and the order resource's refund reports the same. This event is the announcement — no separate wallet.credited event
accompanies a refund. Revoke whatever you delivered against the order on your side, and reconcile
the credit in your books against data.orderId.

Delivery contract — every Xegora webhook is delivered the same way; see order.processing.

Payload

Envelope for order.refunded — the order's money came back to the wallet: a delivered order was refunded and the wallet credited by the order total less any cashback share the order had paid (taken back in the same transaction), or the purchase was refunded before delivery and its reservation released. data.refund breaks the amounts down. No separate wallet.credited event accompanies a refund.

uuid

required

Stable event id (UUID), derived from the order and the event type. The X-Xegora-Event-Id header carries the same value without dashes — dedupe on the header form.

type

const

enum

required

Allowed:

occurredAtUtc

date-time

required

data

object

required

The order snapshot every order event carries.

Headers

X-Xegora-Event-Id

string

required

^[0-9a-f]{32}$

The event's stable unique id — your deduplication key, identical on every retry. It is the envelope's id without dashes (32 lowercase hex characters), and it is the exact string signed inside X-Xegora-Signature.

X-Xegora-Timestamp

string

required

^[0-9]+$

Unix seconds at signing time — your freshness check. Reject deliveries more than 5 minutes from your clock.

X-Xegora-Signature

string

required

^v1=[0-9a-f]{64}$

v1= followed by 64 lowercase hex characters: HMAC-SHA256 over the UTF-8 string {X-Xegora-Timestamp}.{X-Xegora-Event-Id}.{raw body}, keyed with your endpoint's xgwh_… signing secret. Verify over the raw request bytes with a constant-time comparison.

X-Xegora-Delivery-Contract

const

enum

required

The delivery-contract version — currently always xegora-webhook-at-least-once-v1.

Allowed:

Response

200

Acknowledged — any 2xx accepts the event. Non-2xx responses and timeouts trigger the retry schedule described under order.processing.