An order was referred to Xegora for review

webhook

order.under_review

Fires the first time an order is referred to Xegora's operators for review — its status becomes
reconciliationrequired, typically because its outcome could not be confirmed — at most once
per order; a later referral of the same order is on its history, not a second event.
data.status is always reconciliationrequired.

The order's funds stay reserved until the review ends in order.fulfilled, order.failed or
order.refunded. Keep the order visible in your back office; GET /api/v1/orders/{orderId}
shows its statusReason, and its history the reason recorded with the referral.

Delivery contract — every Xegora webhook is delivered the same way; see order.processing.
Subscribe your endpoint to this event type in the dashboard to receive it.

Payload

Envelope for order.under_review — emitted at most once per order, the first time it is referred to Xegora for review. Its funds stay reserved until the review ends.

uuid

required

Stable event id (UUID), derived from the order and the event type. The X-Xegora-Event-Id header carries the same value without dashes — dedupe on the header form.

type

const

enum

required

Allowed:

occurredAtUtc

date-time

required

data

object

required

The order snapshot every order event carries.

Headers

X-Xegora-Event-Id

string

required

^[0-9a-f]{32}$

The event's stable unique id — your deduplication key, identical on every retry. It is the envelope's id without dashes (32 lowercase hex characters), and it is the exact string signed inside X-Xegora-Signature.

X-Xegora-Timestamp

string

required

^[0-9]+$

Unix seconds at signing time — your freshness check. Reject deliveries more than 5 minutes from your clock.

X-Xegora-Signature

string

required

^v1=[0-9a-f]{64}$

v1= followed by 64 lowercase hex characters: HMAC-SHA256 over the UTF-8 string {X-Xegora-Timestamp}.{X-Xegora-Event-Id}.{raw body}, keyed with your endpoint's xgwh_… signing secret. Verify over the raw request bytes with a constant-time comparison.

X-Xegora-Delivery-Contract

const

enum

required

The delivery-contract version — currently always xegora-webhook-at-least-once-v1.

Allowed:

Response

200

Acknowledged — any 2xx accepts the event. Non-2xx responses and timeouts trigger the retry schedule described under order.processing.